Azure VPN Gateway - Custom BGP Routes

Question

Azure VPN Gateway - Custom BGP Routes

Phil 291

Hello Community,

i have a short Question about the Azure VPN Gateway and BGP Routes.
i would like to give my routes trough the other side the tunnel. On which Point must i configure this?

Its right that i must configure this at the point "Custom Selectors" on the Connection?

Thanks fo the help?

Greetings
Phil

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-08T12:43:09.63+00:00

Hi @PhilippGerber-6516,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to know where to configure your custom BGP routes.

I assume you are trying to add custom routes that belong to/is going to be managed by the On-Premises side.
Azure can only advertise the VNet address range (along with peered Vnets) via BGP.

You should configure your OnPremises VPN device to advertise the custom BGP routes.
Any Route-based VPN Gateway from Azure end would accept the ranges coming from OnPremises via BGP.

Kindly let me know if you require more details on this.

Cheers,
Kapil
Phil 291 Reputation points

2022-09-08T13:04:39.167+00:00

Hey Kapil,

thanks for your Answer.
I would like to bring specific Routes from Azure to the local Network.

My question was whether this is the correct way to give specific BGP routes?

Best Regards,
Phil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-09T03:03:48.317+00:00

Hi @PhilippGerber-6516,

Azure always advertises the entire VNet + Peered VNets' address range if BGP is enabled.
The same is true for any Route-based VPN gateway.
We cannot modify this behavior at Platform level.

Your requirement can be achieved by using a PolicyBased VPN gateway, however, there are many limitations and restrictions with Policy-based.
Only Basic SKU supports Policy-based gateway and it does not support BGP.

You can use this command to configure your custom Traffic Selectors :
https://learn.microsoft.com/en-us/powershell/module/az.network/new-azipsectrafficselectorpolicy?view=azps-8.3.0

If your end goal is to restrict certain part of VNet to OnPremise users, we recommend you leverage NSG and block outbound and inbound traffic.

Hope this helps.
Please do let us know should you require additional information.

Thanks,
Kapil
Phil 291 Reputation points

2022-09-09T11:00:17.003+00:00

Hey Kapil,

many thanks for this Answer it was very helpful.

So let me final unterstand your Comment:

1.)
When i have a route Based VPN Gateway with active BGP, the Route which is advertises to Onpremise is the Vnet + Vnet Peered and not the Route "0.0.0.0 - 255.255.255.255".
It is correct?

2.)
So the Custom Traffic Selectors can only Use with Policy Based VPN Gateway.
True?

3.)
So when i configure this custom selectors with a route based vpn Gateway. It has no effect? Right?

the problem is that the dot opposite says that it gets the route "0.0.0.0 - 255.255.255.255" from the Azure VPN gateway.
But i think its false and when you say the gateway advertise only the VNET + Peers, so its right for me.

Regards,
Phil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-12T08:50:38.127+00:00

Hi @PhilippGerber-6516,

1)
The Traffic Selector that gets negotiated will be 0.0.0.0 - 255.255.255.255 only.
However, the BGP session gets updated only with the VNet + Peered VNets' address range.

i.e, When BGP is enabled, we do not get an option to have a "custom Address range".

2) 3)
Custom Traffic Selectors can only Use with Policy Based VPN Gateway and also Route Based Gateways
The catch here is that, you should enable "Use policy based traffic selector" and disable BGP
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#can-i-specify-my-own-policy-based-traffic-selectors

I shall summarize our discussion and post it as an answer. Please consider accepting it so that other community members can be benefitted.

Cheers,
Kapil

Accepted answer

0 additional answers

Your answer

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-08T12:43:09.63+00:00

Hi @PhilippGerber-6516,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to know where to configure your custom BGP routes.

I assume you are trying to add custom routes that belong to/is going to be managed by the On-Premises side.
Azure can only advertise the VNet address range (along with peered Vnets) via BGP.

You should configure your OnPremises VPN device to advertise the custom BGP routes.
Any Route-based VPN Gateway from Azure end would accept the ranges coming from OnPremises via BGP.

Kindly let me know if you require more details on this.

Cheers,
Kapil
Phil 291 Reputation points

2022-09-08T13:04:39.167+00:00

Hey Kapil,

thanks for your Answer.
I would like to bring specific Routes from Azure to the local Network.

My question was whether this is the correct way to give specific BGP routes?

Best Regards,
Phil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-09T03:03:48.317+00:00

Hi @PhilippGerber-6516,

Azure always advertises the entire VNet + Peered VNets' address range if BGP is enabled.
The same is true for any Route-based VPN gateway.
We cannot modify this behavior at Platform level.

Your requirement can be achieved by using a PolicyBased VPN gateway, however, there are many limitations and restrictions with Policy-based.
Only Basic SKU supports Policy-based gateway and it does not support BGP.

You can use this command to configure your custom Traffic Selectors :
https://learn.microsoft.com/en-us/powershell/module/az.network/new-azipsectrafficselectorpolicy?view=azps-8.3.0

If your end goal is to restrict certain part of VNet to OnPremise users, we recommend you leverage NSG and block outbound and inbound traffic.

Hope this helps.
Please do let us know should you require additional information.

Thanks,
Kapil
Phil 291 Reputation points

2022-09-09T11:00:17.003+00:00

Hey Kapil,

many thanks for this Answer it was very helpful.

So let me final unterstand your Comment:

1.)
When i have a route Based VPN Gateway with active BGP, the Route which is advertises to Onpremise is the Vnet + Vnet Peered and not the Route "0.0.0.0 - 255.255.255.255".
It is correct?

2.)
So the Custom Traffic Selectors can only Use with Policy Based VPN Gateway.
True?

3.)
So when i configure this custom selectors with a route based vpn Gateway. It has no effect? Right?

the problem is that the dot opposite says that it gets the route "0.0.0.0 - 255.255.255.255" from the Azure VPN gateway.
But i think its false and when you say the gateway advertise only the VNET + Peers, so its right for me.

Regards,
Phil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-09-12T08:50:38.127+00:00

Hi @PhilippGerber-6516,

1)
The Traffic Selector that gets negotiated will be 0.0.0.0 - 255.255.255.255 only.
However, the BGP session gets updated only with the VNet + Peered VNets' address range.

i.e, When BGP is enabled, we do not get an option to have a "custom Address range".

2) 3)
Custom Traffic Selectors can only Use with Policy Based VPN Gateway and also Route Based Gateways
The catch here is that, you should enable "Use policy based traffic selector" and disable BGP
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#can-i-specify-my-own-policy-based-traffic-selectors

I shall summarize our discussion and post it as an answer. Please consider accepting it so that other community members can be benefitted.

Cheers,
Kapil

Answer 1

Hi @PhilippGerber-6516,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to know where to configure your custom BGP routes.

Azure can only advertise the VNet address range (along with peered Vnets) via BGP.

For a custom Range from OnPremises side

You should configure your OnPremises VPN device to advertise the custom BGP routes.
Any Route-based VPN Gateway from Azure end would accept the ranges coming from OnPremises via BGP.

For a custom Range from Azure side

As stated, a Route-based VPN gateway with BGP enabled would only advertise the VNet address range (along with peered Vnets) via BGP.

A Policy-based Gateway can support this.
Or a Route-based VPN gateway without BGP and "Use policy based traffic selector" enabled, gives you the flexibility to add your custom routes. (this makes the connection similiar to a Policy-based gateway)

Refer :

Feel free to let us know should you have any additional questions on this, I shall be glad to continue our discussion.

Thanks,
Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

-

Share via

Azure VPN Gateway - Custom BGP Routes

0 additional answers

Your answer