Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,693 questions
Adding a VPN Gateway to an ExpressRoute-connected subnet
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 11%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
alexnetsec
0
Reputation points
How can I add a VPN Gateway to a subnet with servers connected to an ExpressRoute? The subnet is /24, and I'd like to add the VPN Gateway to second the ExpressRoute and potentially take over due to limited traffic not justifying the ExpressRoute cost. Although the subnet is bigger than the requirements, the VPN Gateway creation process doesn't allow me to select it. What can I do to resolve this issue?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,201 Reputation points Microsoft Employee2024-01-22T20:29:09.52+00:00 @alexnetsec
Thank you for reaching out.I understand that you wish to add an Azure VPN Gateway to a subnet where Azure Express Route is already configured. The subnet size is /24.
Based on your statement above.
Although the subnet is bigger than the requirements, the VPN Gateway creation process doesn't allow me to select it.
Based on the limitation here The gateway subnet must be /27 or a shorter prefix, such as /26, /25, or you receive an error message when you add the virtual network gateway. Which is true in your case. Can you please validate the points below and see if that helps in resolving the issue.
In order to configure this, you need to add additional Virtual network gateway of type VPN as shown here. Just take a note of following points
- The GatewaySku is only supported for VpnGw1, VpnGw2, VpnGw3, Standard, and HighPerformance VPN gateways.
- ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU
- The VpnType must be RouteBased
- If you want to enable connectivity between one of your local networks that is connected to ExpressRoute and another of your local network that is connected to a site-to-site VPN connection, you need to set up Azure Route Server.
- ExpressRoute co-existence with VPN gateway is supported, but only for IPv4 traffic. IPv6 traffic isn't supported for VPN gateways.
Hope this helps! Please let me know if you have any questions. Thank you!
-
alexnetsec 0 Reputation points
2024-01-22T20:44:22.0633333+00:00 Many thanks for your quick answer. To follow-up on the requirement, the local routing is now done on the firewall to the ExpressRoute next-hop and the idea is to create an IPSEC VPN on the same firewall to modify the routing from the ER to the VPN. I will check the SKU requirement. All traffic is IPV4. From all this, it's not clear if we need a Route Server or not. Technically, this is the same on-premises endpoint which would have ER and Route-based VPN connectivity concurrently until we validate VPN and can remove the ER component.
-
ChaitanyaNaykodi-MSFT 27,201 Reputation points Microsoft Employee
2024-01-29T22:31:13.55+00:00 @alexnetsec
Thank you for getting back and apologies for the delay here. Just wanted to do a quick follow and check if Changing the VPN Gateway SKU helped in resolving the issue?As you are validating the VPN Gateway and removing the Express route, I too do not think there will be a requirement to implement a route server. If it helps you can take a look at this doc for difference in routing for Express Route and VPN.
-
alexnetsec 0 Reputation points
2024-01-30T08:48:54.2633333+00:00 Hi @ChaitanyaNaykodi-MSFT , We could implement the VPN Gateway to have both IPSEC and ExpressRoute. Now I understand that an ExpressRoute will always have priority, so I wonder if it's possible to disable it without deleting it the time we test the failover to the VPN? We'd like to keep the ExpressRoute concurrent to the VPN for observation purposes before definitely switching.
Sign in to comment
Sign in to answer