Azure VPN Gateway Active Standby to Active- Active

Question

Azure VPN Gateway Active Standby to Active- Active

Lavakumar R 36

Azure VPN Gateway Active-Standby to Active- Active along with the BGP enablement requires downtime? Note: We are not running BGP sessions at present. In short the current setup is active - standby without BGP configuration

GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2024-01-25T14:30:21.6866667+00:00

@Lavakumar R , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

Accepted answer

0 additional answers

Your answer

GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2024-01-25T14:30:21.6866667+00:00

@Lavakumar R , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

Answer 1

Hello @Lavakumar R ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you've an active-standby Azure VPN gateway with no BGP sessions running at present and would like to change it to active-active mode. You would like to know if this active-active mode along with BGP enablement requires downtime.

When enabling active-active mode on an active-standby VPN gateway, ideally, there should not be any connectivity issues. However, it is recommended to do this in a planned maintenance as I've seen customers facing a 10-20 minute downtime/disconnection.

Active-active gateways have two Gateway IP configurations and two public IP addresses, so you'll need to configure your on-premises VPN device to accept or establish two S2S VPN tunnels to those two Azure VPN gateway public IP addresses.

If there is only one on-premises VPN device (as shown below), the active-active connection can work with or without BGP protocol.

User's image

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-activeactive-rm-powershell#part-2---establish-an-active-active-cross-premises-connection

BGP is only required when use multiple VPN devices from your on-premises network to connect to your Azure VPN gateway as shown below:

User's image

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto

Kindly let us know if the above helps or you need further assistance on this issue.

Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.

Lavakumar R 36 Reputation points

2024-01-24T12:48:26.7866667+00:00

Thanks for clarification. 10- 20 minutes disconnection/downtime - with regards to this point . Does the existing tunnels come back automatically or does Onpremise team need to do anything from their side?
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2024-01-24T13:47:13.3466667+00:00

Hello @Lavakumar R , the existing tunnels should come back up automatically as long as the setup on both Azure and on-premises side matches and the configuration is correct.

When you configure your on-premises VPN device to accept or establish two S2S VPN tunnels to the two Azure VPN gateway public IP addresses (active-active), there may not be much configuration difference but if you enable BGP, then there are places where it could go wrong if not configured properly.

If you enable BGP and the configuration is not correct, then there could be issues.

When enabling BGP, you will enable it on the gateway, on the local network gateway, your on-premises VPN device and the S2S connection in Azure.

Important configuration considerations to take note of:

https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto#important-configuration-considerations

Regards,

Gita

Share via

Azure VPN Gateway Active Standby to Active- Active

0 additional answers

Your answer