Configuring Static Routes for Multiple On premises VPN tunnle

Question

Configuring Static Routes for Multiple On premises VPN tunnle

SJ 0

I am trying to ad multiple VPN tunnels to an existing VNet GW with SKUVpnGw1AZ. the existing default route is below

source :Virtual Network Gateway : Address: 10.0.0.0/12 : Next Hop Type : Virtual Network Gateway: Next Hop IP : (public IP of S2S).

The IP Address 10.16.0.0/12 is configured in the Local Network Gateway of S2S VPN1

I want to create more Local Network Gateway (S2S VPN2 .. S2S VPN5) to other On prem sites but address range of every other On prem falls into the same range of (10.0.0.0/12) eg. 10.10.0.0/24.

What will be the next hop type and IP when Creating a UDR ? Also Do I need to change the addresses associated with the local Network gateway of the First Tunnel.

source :Virtual Network Gateway : Address: 10.30.0.0/45 : Next Hop Type : ? : Next Hop IP : ?

Below is something I found in Azure Document and this what I am trying to implement. The Only difference is I have one On prem working tunnel with summarize routes of all the on prem Networks.

User's image

Configure Route Tables (UDRs):

You can use User-Defined Routes (UDRs) in route tables to specify how traffic should be routed between your Azure virtual network and the on-premises networks.
Create route tables and add routes that define the destination network (on-premises network) and the next hop, which should be the corresponding Azure VPN gateway.
You can either propagate routes learned from your on-premises VPN devices automatically or manually add routes to your route tables.
Ensure you're not creating conflicting routes, as this can lead to connection issues.

Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-13T19:46:14.55+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-14T17:00:36.8+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Report a concern
SJ 0 Reputation points

2025-05-14T21:12:15.4433333+00:00

Hi Praveen,

Thanks for looking into this my my first iteration will not use UDR, but at the same time not to change the summary route in the existing Tunnel but use a more specific route on the new one. Which I suppose will not work as they will be overlapping. However you also mentioned "Due to the more specific routes created in the new LNG, they are given first preference from the Azure side." So would it not pass all the traffic via old LNG except for the one in new LNG. Also what will happen to old LNG, if I create a new one.
SJ 0 Reputation points

2025-05-14T21:13:00.0766667+00:00

I will update once I implement the change.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-15T20:36:22.9666667+00:00

Hello SJ

The more specific routes created in the new LNG; they are given first preference from the Azure side.
No, you cannot directly use the same address ranges in two "lungs" (or sites) of a VPN tunnel. Overlapping IP addresses will cause routing conflicts and prevent communication between the two networks. Instead, you'll need to use different, non-overlapping IP address ranges for each site connected by the VPN.

IP Address Conflicts:

If both sites use the same IP address range (e.g., 192.168.1.0/24), the VPN tunnel will not know which network to route traffic to. This is because all traffic will be directed to the same local IP address.

You can use BGP: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp-overview

Once your implementation is complete, please let me know the outcome.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-16T18:08:35.93+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider a "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-19T17:38:04.82+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider a "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

1 answer

Your answer

Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-13T19:46:14.55+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-14T17:00:36.8+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Report a concern
SJ 0 Reputation points

2025-05-14T21:12:15.4433333+00:00

Hi Praveen,

Thanks for looking into this my my first iteration will not use UDR, but at the same time not to change the summary route in the existing Tunnel but use a more specific route on the new one. Which I suppose will not work as they will be overlapping. However you also mentioned "Due to the more specific routes created in the new LNG, they are given first preference from the Azure side." So would it not pass all the traffic via old LNG except for the one in new LNG. Also what will happen to old LNG, if I create a new one.
SJ 0 Reputation points

2025-05-14T21:13:00.0766667+00:00

I will update once I implement the change.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-15T20:36:22.9666667+00:00

Hello SJ

The more specific routes created in the new LNG; they are given first preference from the Azure side.
No, you cannot directly use the same address ranges in two "lungs" (or sites) of a VPN tunnel. Overlapping IP addresses will cause routing conflicts and prevent communication between the two networks. Instead, you'll need to use different, non-overlapping IP address ranges for each site connected by the VPN.

IP Address Conflicts:

If both sites use the same IP address range (e.g., 192.168.1.0/24), the VPN tunnel will not know which network to route traffic to. This is because all traffic will be directed to the same local IP address.

You can use BGP: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp-overview

Once your implementation is complete, please let me know the outcome.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-16T18:08:35.93+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider a "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Praveen Bandaru 5,210 Reputation points Microsoft External Staff Moderator

2025-05-19T17:38:04.82+00:00

Hello SJ

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider a "Accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 1

Hello SJ

What will be the next hop type and IP when Creating a UDR ? Also Do I need to change the addresses associated with the local Network gateway of the First Tunnel.

Yes, you are correct. You need to change the address associated with the local Network gateway of the First Tunnel.

Since no on-premises address should overlap, and there is no routing weight concept in the VPN tunnel, the on-premises IPs listed in the LNG must be unique.

Due to the more specific routes created in the new LNG, they are given first preference from the Azure side. Please ensure that the on-premises traffic enters the same tunnel to avoid connectivity issues.

source :Virtual Network Gateway : Address: 10.30.0.0/45 : Next Hop Type : ? : Next Hop IP : ?

If you don't have any firewalls or NVA's, there is no need to use UDR's because Azure will automatically learn the routes from on-premises and re-advertise them to the same gateway.

In the diagram you shared, you can see that the on-premises ranges are different, and there is no overlap between the three networks.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Configuring Static Routes for Multiple On premises VPN tunnle

1 answer

Your answer