Jump to content

- - - - -

Create an Ultra High Available on-prem Azure VPN Connection

  Posted by Pantelis Apostolidis , in Azure 22 October 2018 · 39 views

<h1 style="text-align: justify;">Create an Ultra High Available on-prem &lt;-&gt; Azure VPN Connection</h1>
<p style="text-align: justify;">At this post we will see how to make a high available connection between our on-premises network and Azure. This way we will have an Active-Active Dual-Redundancy VPN Connection.</p>
<p style="text-align: justify;">The idea behind this is that we have a router/firewall cluster,connected with two ISPs and we want to also have a VPN connection with Azure using both ISPs actively. I call this an end-to-end high available connectivity between our on-premises infrastructure and Azure. Actually the active-active dual redundant connections needs to have two different on-premises VPN devices, but we can accomplish almost the same functionality with one device and two different interfaces with two different ISPs.</p>
<p style="text-align: justify;"><img class="alignnone wp-image-2170 size-full" style="font-size: 1.0625rem;" src="https://www.e-aposto...zure-vpn-1.jpg"alt="VPN Connectionv" width="704" height="308" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/active-active-azure-vpn-1.jpg 704w, https://www.e-aposto...n-1-300x131.jpg 300w, https://www.e-aposto...n-1-600x263.jpg 600w" sizes="(max-width: 704px) 100vw, 704px" /></p>
<p style="text-align: justify;">The requirement for this topology, except the router/firewall cluster and the two ISPs is that the Azure VPN Gateway must be Standard or HighPerformance SKU. The Basic SKU does not support Active-Active mode.</p>
<p style="text-align: justify;">As you can see at the above diagram, the Active-Active VPN Gateway created two Active VPN Nodes. The connection of each node to each on-premises network interface in a mesh topology. All network traffic is distributed through all the connections. In order to accomplish this connectivity we need to also enable BGP to both on-premises device and Azure VPN Gateway with different ASN.</p>
<h2 style="text-align: justify;">Lets lab it:</h2>
<p style="text-align: justify;">Create a Virtual Network Gateway, VPN, Route Based and SKU VpnGw1 or larger</p>
<p style="text-align: justify;">Enable active-active mode, this will create two nodes, and give the names of the two Public IPs.</p>
<p style="text-align: justify;">Check the Configure BGB ASN and change the default ASN, I used 65510</p>
<p style="text-align: justify;">wait a lot… more than the typical 45 minutes, a lot more…</p>
<p id="OszBBli" style="text-align: justify;"><img class="alignnone wp-image-2177 size-full" src="https://www.e-aposto...2a3bf078d2.png"alt="VPN Connection" width="529" height="856" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a3bf078d2.png 529w, https://www.e-aposto...8d2-185x300.png 185w" sizes="(max-width: 529px) 100vw, 529px" /></p>
<p id="wpShlpu" style="text-align: justify;">When the gateway is created you will see that the public ip address is called “First public IP address”. If you click the “see more” link you will see the second IP too.</p>
<p id="GrftlaG" style="text-align: justify;"><img class="alignnone wp-image-2175 size-full" src="https://www.e-aposto...2a1260c0d0.png"alt="VPN Connection" width="1011" height="355" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a1260c0d0.png 1011w, https://www.e-aposto...0d0-300x105.png 300w, https://www.e-aposto...0d0-768x270.png 768w, https://www.e-aposto...0d0-600x211.png 600w" sizes="(max-width: 1011px) 100vw, 1011px" /></p>
<p style="text-align: justify;">You can see both IP form the Properties page too.</p>
<p id="qdnpICx" style="text-align: justify;"><img class="alignnone wp-image-2178 size-full" src="https://www.e-aposto...2a4757d5bc.png"alt="VPN Connection" width="521" height="499" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a4757d5bc.png 521w, https://www.e-aposto...5bc-300x287.png 300w" sizes="(max-width: 521px) 100vw, 521px" /></p>
<p style="text-align: justify;">Second we need to create two Local network Gateways, to represent the two interfaces of our on-premises device. Both must be created with the same ASN. This ASM must be different than the Gateways’ and this ASN must be configured at the configuration of the local devices VPN connection.</p>
<p id="EOHeVpw" style="text-align: justify;"><img class="alignnone wp-image-2179 size-full" src="https://www.e-aposto...2a4e112829.png"alt="VPN Connection" width="807" height="505" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a4e112829.png 807w, https://www.e-aposto...829-300x188.png 300w, https://www.e-aposto...829-768x481.png 768w, https://www.e-aposto...829-600x375.png 600w" sizes="(max-width: 807px) 100vw, 807px" />]</p>
<p style="text-align: justify;">Now, create the connection</p>
<p id="ptblbOY" style="text-align: justify;"><img class="alignnone wp-image-2180 size-full" src="https://www.e-aposto...2a6ac7bd46.png"alt="VPN Connection" width="1229" height="386" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a6ac7bd46.png 1229w, https://www.e-aposto...bd46-300x94.png 300w, https://www.e-aposto...d46-768x241.png 768w, https://www.e-aposto...46-1024x322.png 1024w, https://www.e-aposto...d46-600x188.png 600w" sizes="(max-width: 1229px) 100vw, 1229px" /></p>
<p style="text-align: justify;">And remember to enable BGP at the Connection’s Configuration</p>
<p id="EjsMsCT" style="text-align: justify;"><img class="alignnone wp-image-2181 size-full" src="https://www.e-aposto...2a73d5c1fd.png"alt="VPN Connection" width="591" height="370" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a73d5c1fd.png 591w, https://www.e-aposto...1fd-300x188.png 300w" sizes="(max-width: 591px) 100vw, 591px" /></p>
<p style="text-align: justify;">As soon as the local device is configured both connections became connected.</p>
<p id="keTsbLI" style="text-align: justify;"><img class="alignnone wp-image-2183 size-full" src="https://www.e-aposto...2a7da5be9e.png"alt="VPN Connection" width="1258" height="420" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a7da5be9e.png 1258w, https://www.e-aposto...e9e-300x100.png 300w, https://www.e-aposto...e9e-768x256.png 768w, https://www.e-aposto...9e-1024x342.png 1024w, https://www.e-aposto...e9e-600x200.png 600w" sizes="(max-width: 1258px) 100vw, 1258px" /></p>
<p style="text-align: justify;">From powershell we can see both local IPs of the two nodes of the Azure VPN Gateway,</p>
<p id="pZQnWld" style="text-align: justify;"><img class="alignnone wp-image-2186 size-full" src="https://www.e-aposto...2a90fd9740.png"alt="VPN Connection" width="632" height="406" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2a90fd9740.png 632w, https://www.e-aposto...740-300x193.png 300w, https://www.e-aposto...740-600x385.png 600w" sizes="(max-width: 632px) 100vw, 632px" /></p>
<h2>Test and Troubleshooting</h2>
<p style="text-align: justify;">Currently the only way to see the connections between the Azure Gateway Nodes and the local devices interfaces is the below powershell command</p>
<p style="text-align: justify;">Get-AzureRmVirtualNetworkGatewayBGpPeerStatus -VirtualNetworkGatewayName “gatewayname” -ResourceGroup “resourcegroupname”</p>
<p id="DXIZKqI" style="text-align: justify;"><img class="alignnone wp-image-2190 size-full" src="https://www.e-aposto...2abf4ecf6d.png"alt="VPN Connection" width="1444" height="419" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2abf4ecf6d.png 1444w, https://www.e-aposto...cf6d-300x87.png 300w, https://www.e-aposto...f6d-768x223.png 768w, https://www.e-aposto...6d-1024x297.png 1024w, https://www.e-aposto...f6d-600x174.png 600w" sizes="(max-width: 1444px) 100vw, 1444px" /></p>
<p style="text-align: justify;">Every time you run this command you get answer from one of the two nodes at random. At the above screenshot, first is one node and second is the other.</p>
<p style="text-align: justify;">The first node’s peer, 192.168.xx.9 shows that is connect<strong>ed</strong> to the 10.xx.xx.2 local network’s peer and connect<strong>ing</strong> at the second peer 10.xx.xx.1</p>
<p style="text-align: justify;">The second node’s peer, 192.168.xx.8 shows that is connect<strong>ed</strong> to the 10.xx.xx.1 local network’s peer and connect<strong>ing</strong> at the second peer 10.xx.xx.2</p>
<p id="LgtabOH" style="text-align: justify;"><img class="alignnone wp-image-2191 size-full" src="https://www.e-aposto...2ad172e960.png"alt="VPN Connection" width="609" height="410" srcset="https://www.e-apostolidis.gr/wp-content/uploads/2018/09/img_5ba2ad172e960.png 609w, https://www.e-aposto...960-300x202.png 300w, https://www.e-aposto...960-600x404.png 600w, https://www.e-aposto...e960-120x80.png 120w" sizes="(max-width: 609px) 100vw, 609px" /></p>
<p style="text-align: justify;">The test I performed was to unplug one interface from the local device. The azure gateway’s first node State was both Connecting and the second node was the same, connecting to .2 and connected to .1. At this test I did lost a single ping.</p>
<p style="text-align: justify;">After that I plugged the cable back, waited less than a minute and unplugged the second cable. Now the first node shows still disconnected but the first node connected to the .2 local IP and connecting to .1. With this test I lost only one ping. Also I realized that it is random which node’s private IP will connect with the local device’s private IP. Both Azure Gateway’s IPs 192.168.x.8 &amp; 9 can connect with the local device’s IP 10.x.x.1 &amp; 2 and this is the magic of the Active-Active Dual Redundancy VPN connection.</p>
<p><a class="a2a_button_email" href="https://www.addtoany...VPN Connection"title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_print" href="https://www.addtoany.com/add_to/print?linkurl=https%3A%2F%2Fwww.e-apostolidis.gr%2Fmicrosoft%2Fazure%2Fcreate-an-ultra-high-available-on-prem-azure-vpn-connection%2F&amp;linkname=Create%20an%20Ultra%20High%20Available%20on-prem%20%20Azure%20VPN%20Connection" title="Print" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share#url=https%3A%2F%2Fwww.e-apostolidis.gr%2Fmicrosoft%2Fazure%2Fcreate-an-ultra-high-available-on-prem-azure-vpn-connection%2F&amp;title=Create%20an%20Ultra%20High%20Available%20on-prem%20%20Azure%20VPN%20Connection" data-a2a-url="https://www.e-apostolidis.gr/microsoft/azure/create-an-ultra-high-available-on-prem-azure-vpn-connection/" data-a2a-title="Create an Ultra High Available on-prem Azure VPN Connection"><img src="https://static.addtoany.com/buttons/share_save_171_16.png" alt="Share"></a></p><p>The post <a rel="nofollow" href="https://www.e-apostolidis.gr/microsoft/azure/create-an-ultra-high-available-on-prem-azure-vpn-connection/">Create an Ultra High Available on-prem &lt;-&gt; Azure VPN Connection</a> appeared first on <a rel="nofollow" href="https://www.e-apostolidis.gr">Apostolidis IT Corner</a>.</p>

<a href="https://www.e-aposto...pn-connection/"class='bbc_url' rel='nofollow external'>Source</a>