Share via

azure vpn gateway bgp nat apipa

56789 10 Reputation points
2024-02-12T18:58:19.51+00:00

Hello, I have a two site to site vpn connection. Connection 1: Client A (Onprem DC with Palo alto) - Azure Vpn GW A. This is a route based vpn with bgp enabled on apipa. Connection 2: Vendor A (Vendor DC with Fortigate) - Azure Vpn GW A. This is a route based vpn with bgp enabled on apipa. VPN gw: VpnGw2 Requirement: 1)To create connection 3: Vendor B(Vendor DC with Palo) - Azure Vpn GW A. This will be route based vpn with bgp enabled on private ip at onprem and on azure vpn gw. i understand that nat does not work when using bgp apipa, but what i want to confirm is if nat will work on connection 3 which will have private bgp ip at onprem and on azure vpn gateway. Since i want to do NAT only on connection 3,will NAT work on connection 3? Attached high level network diagram. vpn-nat-public

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,796 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Luis Arias 8,621 Reputation points Volunteer Moderator
    2024-02-12T20:12:59.7333333+00:00

    Hi 56789,

    Based on the image, NAT (Network Address Translation) should theoretically work on Connection 3. This is because you’re planning to use private BGP IP addresses at both ends (on-premises and Azure VPN gateway).

    If the on-premises VPN router uses regular, non-APIPA address and it collides with the virtual network address space or other on-premises network spaces, ensure the IngressSNAT rule will translate the BGP peer IP to a unique, non-overlapped address and put the post-NAT address in the BGP peer IP address field of the local network gateway.> NAT isn't supported with BGP APIPA addresses.> https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#does-nat-work-with-bgp-connections

    The use of private IP addresses for BGP should not be affected by the limitations associated with APIPA (Automatic Private IP Addressing) addresses, which are used in Connections 1 and 2. Be sure the on-premises BGP routers advertise the exact prefixes as defined in the IngressSNAT rules.

    Additional MS reference:

    Luis

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.