Not able to establish BGP peering with Active Active VPN GW using APIPA IP with on-prem

Shaileshkumar Beldar 1

Hello All,

I am trying to establish active-active connection with our two on-prem sites ( both have palo alto fw as connection end-point for vpn). For one site VPN tunnel is coming up and actively exchanging routes but for another site tunnel is not coming up. I am using APIPA IP range 169.254.21.0/30 for site-A & 169.254.21.4/30 for site-B. I am using primary public IP for site-A and Secondary for site-B. I have also tried primary for both sites but it didn't work. I have also tried 10.x.x.x/30 ranges for both tunnels but for 10.x.x.x/30 IP for none of the tunnel bgp peering is coming up. I have also tried different other combination but none of them are working so not sure where exactly I am making mistake so can somebody please help me with it? please let me know if you need more information.

Regards,
Shailesh

MartinJaffer-MSFT 26,081 Reputation points

2022-08-04T17:01:13.19+00:00

This doesn't appear to have anything to do with Azure Data Share, so I have changed tag to azure networking.
Shaileshkumar Beldar 1 Reputation point

2022-08-04T19:01:32.817+00:00

Thank you @MartinJaffer-MSFT .

Hello @Azure Networking : Any comment on described issue will be much appreciated.
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2022-08-05T13:43:39.82+00:00
Hi @Shaileshkumar Beldar ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to establish an Active-Active Tunnel between Two different OnPremises with APIPA .

Wrt 10.x.x..x/30,

Please note that APIPA Ranges are supported only in the range of 169.254.21.0 to 169.254.22.255

This is the reason 10.x.x.x/30 is failing.

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto

Now,

I am afraid I do not understand how you are using the secondary IP of the VPN to establish a connection.

When a VPN Gateway is configured as Active-Active, VPN Gw will try to establish 2 Site-to-Site Tunnels to a single OnPrem.

Each of the OnPrem devices must be configured to accept connections from both the IP Addresses of the gateway.

I see you have mentioned even configuring primary IP in seconday OnPrem, siteB (the one with issue) but issue prevails.

By the looks of it, it could be a configuration issue from siteB. Can you please check if you are able to establish a connection to siteB without APIPA.

That should help us isolate of the issue is with APIPA or with the VPN Device.

Please feel free to let me know if you have any follow-up questions on this.

Cheers,
Kapil
Shaileshkumar Beldar 1 Reputation point

2022-08-05T14:25:06.233+00:00
Thank you so much anonymous user-MSFT

Please note that APIPA Ranges are supported only in the range of 169.254.21.0 to 169.254.22.255 : I am using same APIPA range which is recommended by MSFT 69.254.21.0/30 for site-A & 169.254.21.4/30.

This is the reason 10.x.x.x/30 is failing : 10.x.x.x/30 IPs I am using is as a part of local n/w gw ( as it is mentioned that APIPA is optional and to configure it we need to configure VPN GW)

When a VPN Gateway is configured as Active-Active, VPN Gw will try to establish 2 Site-to-Site Tunnels to a single OnPrem. : How can I connect two different On-prem site to single VPN GW using BGP peering is there any another document I need to refer?

Can you please check if you are able to establish a connection to siteB without APIPA. - if I will not use APIPA what BGP peering IPs I should use? any comment on it
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2022-08-05T16:57:12.443+00:00
Hi @Shaileshkumar Beldar ,

Wrt,

How can I connect two different On-prem sites to a single VPN GW using BGP peering is there any another document I need to refer?

You can directly create two connections, one to each Site (A and B).

Enable BGP on both of them

Make sure you configure the SiteA and SiteB's VPN devices to accept connection requests from both the public IPs of the VPN gateway (if you require Active-Active)

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-multi-site-to-site-resource-manager-portal

The single primary IP of VPN gateway is capable of establishing multiple connections to various OnPrem devices without the need of a secondary IP

You can also make the VPN Gateway as Active-Passive and use the IP of the VPN Gw to establish connections to both of the OnPrem devices

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

If I will not use APIPA what BGP peering IPs I should use?

Azure will automatically assign private IP address(es) from the GatewaySubnet prefix range for VPN Gateway

From the OnPrem device side, you should use the BGP address of the VPN device

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/bgp-howto
-

Please feel free to let me know if you have further questions on this.

Thanks,
Kapil.
Raviraj Velankar 91 Reputation points

2022-09-08T10:56:13.487+00:00

Hello Kapil,

Sincere Apologies to reply to this post and breaking the thread. I have query similar to this scenario.
I have following query. When we have S2S IPSec VPN over Express Route Private Peering connection with BGP in that case Virtual Network IP address range ( in which ER GW and VPN GW exist) and peered virtual network IP address range gets advertised via both ER Gateway towards ER Circuit & BGP neighbors and VPN GW towards the IPSec tunnel & BGP neighbors. Do we have any config. settings in Azure VPN Gateway and precisely in S2S VPN connection config page such as that we can advertise IP prefixes with most specific mask towards On-premise end VPN device or Router so that On-premise VPN device/Router prefers IPSec tunnel path instead of physical Express Route path.
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2022-09-09T14:56:45.293+00:00

Hi @ RavirajVelankar-3161,

To address your question,
Currently, path preference should be configured from your OnPrem Router or OnPrem VPN Device.
As of now, there is no mechanism in Azure to influence routing when it comes to BGP.

Azure honors AS Path prepending in BGP
So, you can lengthen the AS Path advertised to make a path less preferable.

Or as a more traditional approach, you can advertise specific route from OnPremises (either CE Router or VPN device) to make it the preferred path.

Refer : https://learn.microsoft.com/en-us/azure/expressroute/expressroute-optimize-routing

Cheers,
Kapil.
Raviraj Velankar 91 Reputation points

2022-09-11T10:28:07.023+00:00

Thank you for response Kapil. Appreciate your inputs.

1 answer

Shaileshkumar Beldar 1 Reputation point

2022-08-08T14:56:46.443+00:00

Hello anonymous user-MSFT

I am so sorry for my late response. I was trying get tunnels up with your instructions. I tried following possible solutions but no success

Used active passive VPN GW with two local N/w GW & azure connection (for each site) connecting to public IP of VPN GW from both on-prem sites ( used 10.x.x.x/30 IP for BGP peering ) : Failed
Used active passive VPN GW with two local N/w GW & azure connection (for each site) connecting to public IP of VPN GW from both on-prem sites ( used 169.254.21.x/30 & 169.254.22.x/30 IP for BGP peering ): Failed
Used active-active VPN GW with two local N/w GW & azure connection (for each site) connecting to primary public IP of VPN GW from both on-prem sites ( used 10.x.x.x/30 IP for BGP peering ) : Failed
Used active-active VPN GW with two local N/w GW & azure connection (for each site) connecting to primary public IP to site-A & secondary to site-B of VPN GW from on-prem sites ( used 10.x.x.x/30 IP for BGP peering ) : Failed
Used active-active VPN GW with two local N/w GW & azure connection (for each site) connecting to primary public IP of VPN GW from on-prem sites ( used 169.254.21.x/30 & 169.254.22.x/30 IP for BGP peering ) : Failed
Used active-active VPN GW with two local N/w GW & azure connection (for each site) connecting to primary public IP to site-A & secondary to site-B of VPN GW from on-prem sites ( used 169.254.21.x/30 & 169.254.22.x/30 IP for BGP peering ) : Failed

Please note: I am getting tunnel UP & running with site-A working absolutely fine but tunnel with Site-B is not coming up, I can see traffic from 169.254.x.x. IPs for site-B on my Palo Alto but tunnel is not coning up. Below is a Screen shot of communication which I can see on my palo alto. Any comment on it?

Thank very much for help :-)
Please sign in to rate this answer.
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2022-08-08T17:33:09.577+00:00

Hi @Shaileshkumar Beldar ,

This issue seems it would require a deeper investigation, so if you have a support plan, I request you file a support ticket.
If else please do let us know, we will try and help you get a one-time free technical support.

Thanks,
Kapil.

Shaileshkumar Beldar 1 Reputation point

2022-08-08T17:55:58.367+00:00

Thank you for your guidance anonymous user-MSFT. I will discussed with my manager and follow the next step.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Not able to establish BGP peering with Active Active VPN GW using APIPA IP with on-prem

1 answer

Your answer