多个 Azure VPN 网关

Question

I have been trying to tackle a problem where I need to create a second VPN tunnel to a site (SiteA), this site already has a VPN tunnel set up with our VPN Gateway.

SiteA is unable to create a second tunnel to our VPN gateway public IP, as a route already exists.

I need to knnow can I add a second IP to the vPN gateway, which I think is a NO, but I can't find anything concrete to validate that, and if that's not possible, can we add a second VPN gateway into the same GatewaySu.net, in our hub .NET.

Although I think this would be problematic as how would the traffic from firewall know which tunnel to send the taffic to.

Some backgound: Hub and spoke design with hub consisting of Az firewall and Az VPN gateway. Peered spokes route through FW to get to VPN gateway. Hope that makes sense.

Thanks in advance.

Answer 1

To create a second VPN tunnel to a site (SiteA), which already has a VPN tunnel set up with your VPN Gateway, you can enable your Azure VPN gateway for an active-active configuration, where both instances of the gateway VMs will establish S2S VPN tunnels to your on-premises VPN device, as shown in the following diagram:

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable#active-active-vpn-gateways

In the Active-active Azure VPN gateway configuration, each Azure gateway instance will have a unique public IP address, and each will establish an IPsec/IKE S2S VPN tunnel to your on-premises VPN device specified in your local.network gateway and connection. You will need to configure your on-premises VPN device to accept or establish two S2S VPN tunnels to the two Azure VPN gateway public IP addresses which are created when active-active option is enabled and because the Azure gateway instances are in active-active configuration, the traffic from your Azure virtual.network to your on-premises.network will be routed through both tunnels simultaneously, even if your on-premises VPN device may favor one tunnel over the other.

To change/update an existing Azure VPN gateway from active-standby to active-active mode, refer the below doc:

https://learn.microsoft.com/en-us/azure/vpn-gateway/active-active-portal#-update-an-existing-vpn-gateway