VPN Gateway Active Active Single Internet

Handian Sudianto 6,101 Reputation points
2025-03-18T12:23:34.0433333+00:00

VPN active active mode like bow pic is applicable if we only have single internet connection in onprem side? Each connection from azure local network gateway can connected to single public ip address in the onprem?

User's image

Azure VPN Gateway
Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,795 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Ganesh Patapati 6,915 Reputation points Microsoft External Staff Moderator
    2025-03-18T18:25:37.55+00:00

    @Handian Sudianto

    Yes, you can configure an Azure VPN Gateway in active-active mode with a single on-premises internet connection and public IP.

    However, on-premises device must terminate two IPsec tunnels from Azure's two VPN Gateway instances to the same on-premises public IP.

    Here, BGP is recommended for dynamic routing and failover. The on-premises device must establish separate BGP sessions with both Azure gateways over the two tunnels.

    While Azure's side is redundant, the on-premises internet connection remains a single point of failure. For full redundancy, consider adding a second on-premises ISP or failover link.

    Topology should be as below.

    Azure VPN Gateway (Active-Active)

    1. VPN Instance 1: Public IP 1 → On-Prem Public IP (Tunnel 1)
    2. VPN Instance 2: Public IP 2 → On-Prem Public IP (Tunnel 2)
    3. On-Prem Device: Single public IP, two tunnels to Azure.

    You can use Active-Active mode with a single internet connection on the on-premises side if you're on-premises VPN device can support handling multiple tunnels.

    Each connection from Azure Local Network Gateway can connect to a single public IP on the on-premises side, but it is possible to have multiple tunnels over that single IP if the device supports it.


    I hope this has been helpful!

    If above is unclear and/or you are unsure about something add a comment below.

    Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.Accepted answer


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.