Following is scenario There is site to site VPN tunnel established between Azure VPN GW (using Private IP address) and On-premise VPN GW (using private IP address) through Express Route Private peering circuit. There is another site to site VPN tunnel established between Azure VPN GW (using Azure VPN GW Public IP address) and On-premise VPN GW (using On-premise VPN GW public IP address) over Internet Whether it is possible to configure these two tunnels as active-standby and if there is a third party NVA in hub virtual network then how to add routes in NVA for these two tunnels which will act as active -standby

Hi @Raviraj Velankar , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are trying to establish an Active-Passive Tunnel between Azure and OnPrem, one via Private IP and other via Public IP. It is possible to deploy Site-to-Site VPN connections over ExpressRoute private peering at the same time as Site-to-Site VPN connections via the Internet on the same VPN gateway. Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering The below article talks about your scenario. https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices The OnPrem VPN 1 represents your Public IP and OnPrem VPN 2 is your Private IP. BGP is required for this configuration. Both the tunnels will be up You can influence which tunnel to pick by using AS Path prepending https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#does-azure-vpn-gateway-honor-as-path-prepending-to-influence-routing-decisions-between-multiple-connections-to-my-on-premises-sites In case you have an NVA in the Hub Vnet, You would have to configure some manual routing with UDRs. For Azure to OnPrem traffic, you have to configure a UDR on the subnets and forward it to the NVA For return traffic, attach a route table in the Gateway subnet and point the next Hop to the NVA. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table Feel free to let me know if you have any follow-up queries on the above. Cheers, Kapil.

Failover between two site to site VPN tunnels configured with Azure VPN GW Private IP address and Public IP address

Accepted answer

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-10T06:09:00.26+00:00
Hi @Raviraj Velankar ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to establish an Active-Passive Tunnel between Azure and OnPrem, one via Private IP and other via Public IP.

It is possible to deploy Site-to-Site VPN connections over ExpressRoute private peering at the same time as Site-to-Site VPN connections via the Internet on the same VPN gateway.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering

The below article talks about your scenario.

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#multiple-on-premises-vpn-devices

The OnPrem VPN 1 represents your Public IP and OnPrem VPN 2 is your Private IP.

BGP is required for this configuration.

Both the tunnels will be up

You can influence which tunnel to pick by using AS Path prepending

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#does-azure-vpn-gateway-honor-as-path-prepending-to-influence-routing-decisions-between-multiple-connections-to-my-on-premises-sites

In case you have an NVA in the Hub Vnet,

You would have to configure some manual routing with UDRs.

For Azure to OnPrem traffic, you have to configure a UDR on the subnets and forward it to the NVA

For return traffic, attach a route table in the Gateway subnet and point the next Hop to the NVA.

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table

Feel free to let me know if you have any follow-up queries on the above.

Cheers,
Kapil.
Please sign in to rate this answer.
Raviraj Velankar 91 Reputation points

2022-08-11T09:29:14.217+00:00

Hi Kapil,

Thanks a lot for providing response and answering the queries. I will reach out in case I have any further query.

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-11T09:33:57.483+00:00

Sure.

Thanks,
Kapil

Raviraj Velankar 91 Reputation points

2022-08-12T10:43:23.13+00:00

Hi Kapilanath,

I have following query. We need to create site to site VPN tunnel over Express Route Private peering using Private IP address of Azure VPN GW and On-premise VPN GW/FW.
In S2S VPN config process, we need to create local network gateway which represents On-premise VPN device or FW. Usually while creating local network GW, we provide public IP address which correspond to On-premise VPN GW/FW public IP. So in this case

whether Azure will allow to create Local Network Gateway with Private IP address ?

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-12T11:30:33.91+00:00

Hi @Raviraj Velankar ,

Yes.
You should be able to create an LNG with Private IP (of the Firewall) in configuration.

Cheers,
Kapil

Raviraj Velankar 91 Reputation points

2022-08-15T14:55:36.127+00:00

Thank you Kapil for the response.

Raviraj Velankar 91 Reputation points

2022-08-17T07:31:54.033+00:00

Hi Kapil,

One more query regarding the throughput of S2S VPN tunnel. As per following URL from Microsoft, S2S vpn tunnel throughput per VPN tunnel is 700 Mbps maximum if we use AES256/SHA256 Encryption Algorithm.

https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

Even if we go for higher version of Azure VPN GW SKUs such as Generation-2 VpnGW3AZ or VpnGW4AZ or VpnGW5AZ, S2S VPN tunnel throughput will remain 700 Mbps if we use encryption as AES256/SHA256. Most of the customer will go with this type or encryption compared to GCMAES256 encryption which gives higher throughput of 2.3 Gbps maximum.

Would like to know is there any way if we can increase VPN tunnel throughput (with AES256/SHA256 encryption) for more than 700 Mbps

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-19T10:40:23.977+00:00

Hi @Raviraj Velankar ,

Greetings.

As of now, we cannot configure the bandwidth of individual tunnel(s).

So, I am afraid with AES256/SHA256 encryption, we can expect a throughput of 700Mbps only.

Cheers,
Kapil

Raviraj Velankar 91 Reputation points

2022-08-22T11:17:12.35+00:00

Hi Kapil,

Thanks for all your help and responses.
One last query from my side is .. If we have active-active Azure VPN GW configured with BGP enabled and we have two site to site VPN tunnels configured to single On-prem VPN GW then whether can we leverage same active-active Azure VPN GWs to terminate client to site VPN tunnels and can use BGP to reach to On-premise IP prefixes learned by BGP. In case of active-active Azure VPN GW, how VPN client files will change

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-23T13:48:53.923+00:00

Hi @Raviraj Velankar ,

By client file, I believe you are referencing the P2S configuration.

With BGP, the OnPrem routes will be advertised to the P2S Clients.
This is by design and you will be able to access OnPrem.

Your scenario is documented here, under "One VNet and a branch office (BGP)"
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#vnetbranch
NOTE : You should manually add these routes for Windows Clients.

Refer "How do I add custom routes to the VPN client?" under https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client

Cheers,
Kapil

Raviraj Velankar 91 Reputation points

2022-09-04T16:40:40.877+00:00

Hi Kapil,

Consider a scenario where we have active-active VPN Gateway at Azure end and single VPN GW at On-premise end and requirement is to build two site to site VPN tunnels over Express Route private peering using private IP address of VPN GW(on both side).
In general, we create Local Network Gateway for each On-premise VPN device however in this scenario, On-premise VPN device is only one but there are two (active-active) VPN GWs at Azure end hence question is ..
whether we are able to create two S2S VPN tunnels using same Local Network Gateway (On-premise VPN device with private IP address) i.e. one for each instance of Azure VPN GW ?
To create S2S VPN connection there is a drop down to select the VPN GW but not sure in case of active-active VPN whether it will allow to select each instance of Azure VPN GWs so that we can create two tunnels or whether it will allow to select only one instance of Azure VPN GW
Appreciate your inputs or guidance in this regard

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-09-05T04:03:21.537+00:00

Hi @Raviraj Velankar ,

Please note that "active-active VPN Gateway" means there are two instances of a single Gateway.
And it does not mean that we have two gateways.

While creating a S2S Connection, you specify a Gateway and LNG (This means, both the instances are included)
This also means that both the instances will try to establish their own Tunnel with the OnPrem device.

To address your question,

You do not have to create two LNGs.

You just have to use a single LNG.

The VPN Gateway will try and establish two Tunnels for a single connection between VPN GW and OnPrem device in case of active-active.

Hope this helps.

Cheers,
Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Failover between two site to site VPN tunnels configured with Azure VPN GW Private IP address and Public IP address

0 additional answers

Your answer