Hello @Adi Wibowo (AP) ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
I understand that you have an existing S2S VPN connection and are planning to deploy an ExpressRoute circuit as the main connection and use S2S VPN as the back-up, but the S2S VPN and ExpressRoute gateways will be in different subscriptions. So, you would like to know if it is possible to configure ExpressRoute and Site-to-Site coexisting connections using different gateway subnets and subscriptions.
No, this is not possible.
As the name suggests, coexisting connections means both the connections co-exists together in the same Vnet but could connect to the same site or different sites depending upon your requirement.
This connection applies only to virtual networks linked to the Azure private peering path. There's no VPN-based failover solution for services accessible through Azure Microsoft peering. The ExpressRoute circuit is always the primary link. Data flows through the Site-to-Site VPN path only if the ExpressRoute circuit fails.
So, to configure ExpressRoute and Site-to-Site coexisting connections, you would need to deploy the ExpressRoute gateway in the same subscription and GatewaySubnet as the S2S VPN gateway.
Points to remember are as below:
- The gateway subnet must be /27 or a shorter prefix such as /26, /25.
- Only route-based VPN gateway is supported.
- ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU.
Kindly let us know if the above helps or you need further assistance on this issue.
Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.