Step-by-Step Guide to Configuring BGP Routing on Azure VPN Gateway

You can configure BGP routing on Azure VPN Gateway to enable dynamic and resilient connections between your cloud and on-premises networks. Using BGP routing helps you adapt to network changes and supports hybrid or multi-cloud setups. Many users face challenges, including integrating routing protocols with Azure’s virtual network system, slow route updates, and the need for keep-alive pings to prevent tunnel downtime.

• You may also encounter issues with network topology, such as incorrect hub-spoke designs or transit routing limitations.
  This guide provides actionable steps, example values, and troubleshooting tips to help you overcome these obstacles.

Key Takeaways

• Prepare by ensuring you have the right Azure permissions and that your on-premises VPN device supports BGP and IKEv2.

• Plan your network carefully with unique IP address spaces, proper subnet naming, and different ASNs for Azure and on-premises networks.

• Create a virtual network with a correctly sized GatewaySubnet and deploy a route-based VPN gateway that supports BGP.

• Configure BGP settings on both Azure and your on-premises device with matching ASNs and peer IPs to enable dynamic route exchange.

• Verify your BGP connection using Azure tools and troubleshoot common issues like mismatched settings or blocked ports to keep your network resilient.

BGP Routing Prerequisites

Tools and Permissions

Before you start, make sure you have the right tools and permissions. You need access to the Azure portal or Azure CLI. Your account must have permission to create and manage virtual networks, VPN gateways, and local network gateways. You also need access to your on-premises VPN device for configuration changes.

Tip: Use an account with the "Network Contributor" role in Azure. This role lets you manage all networking resources without giving full admin rights.

You must also check that your on-premises VPN device supports BGP routing and IKEv2. Many popular devices work with Azure VPN Gateway, including:

• Cisco ASA, ASR, and ISR series

• Juniper MX, SRX, J-Series, ISG, and SSG

• Palo Alto Networks (PAN-OS 7.1.4+)

• Barracuda CloudGen Firewall (6.2.0+)

• Check Point Security Gateway

• F5 BIG-IP series

• WatchGuard devices

• Microsoft Routing and Remote Access Service (Windows Server 2012+)

Network Planning

Careful planning helps you avoid common mistakes and ensures a smooth BGP routing setup. Follow these steps:

1. Plan your IP address spaces to avoid overlaps. For example, use 10.20.0.0/16 for Azure and 10.50.200.0/16 for other clouds.

2. Name the subnet for your VPN gateway exactly as "GatewaySubnet".

3. Choose different Autonomous System Numbers (ASNs) for Azure and your on-premises network. For example, use 65515 for Azure and 65516 for your other site.

4. Decide if you need an active-active gateway for high availability.

5. Allocate enough time for deployment. Setting up a VPN gateway can take 45 minutes or more.

6. Use private IP ranges (RFC 1918) and avoid reserved IP blocks.

7. Use IP Address Management (IPAM) tools to track your address spaces.

Note: Azure automatically assigns a private BGP IP from the GatewaySubnet. If your on-premises device uses an APIPA address (169.254.x.x), you must set a matching APIPA address in Azure. APIPA addresses must not overlap between devices.

Supported Scenarios

Azure VPN Gateway with BGP routing supports many hybrid and multi-cloud scenarios. You can connect your on-premises network to Azure, link multiple Azure regions, or build connections between Azure and other clouds like AWS or GCP. BGP routing lets your networks exchange routes dynamically, which helps with failover and scaling.

When using APIPA addresses for BGP, remember that the on-premises device must start the BGP peering session. For active-active gateways, assign unique APIPA addresses for each gateway instance. Always check that your device and Azure configuration match, especially for ASN and BGP peer IPs.

Azure VPN Gateway Setup

Virtual Network and Subnets

You start by creating a virtual network and the required subnets. This forms the foundation for your Azure VPN Gateway deployment.

1. Log in to your Azure subscription and go to "All Services."

2. Select "Virtual Networks" and choose "+Add" to create a new virtual network.

3. Enter a name, select a resource group, and pick a region close to your users or on-premises site.

4. Set the address space, such as 172.16.0.0/22, to cover your planned network needs.

5. Add a subnet for your workloads. For example, name it "AppSubnet" and assign an address range like 172.16.1.0/24.

6. Click "Create" and wait for the deployment to finish.

After the virtual network is ready, you need to add a special subnet for the VPN gateway.

1. Open your virtual network and go to "Settings" > "Subnets."

2. Click "+Gateway Subnet." The name "GatewaySubnet" will auto-populate. Do not change it.

3. Assign an address range for the gateway subnet. Use at least a /27 mask, such as 172.16.0.0/27. This gives enough IP addresses for the gateway and future growth.

4. Save the subnet. Avoid attaching Network Security Groups (NSGs) or user-defined routes to the GatewaySubnet. These can block gateway traffic and cause issues.

Tip: Always size the GatewaySubnet at /27 or larger. This supports BGP routing and allows for scaling later.

VPN Gateway Deployment

With your network and subnets in place, you can deploy the VPN gateway.

1. Go to "All Services" and select "Virtual Network Gateways."

2. Click "+Add" to start the creation process.

3. Fill in the gateway name and select the same region as your virtual network.

4. Set the gateway type to "VPN" and the VPN type to "Route-based." Only route-based gateways support BGP routing.

5. Choose a SKU of VpnGw1 or higher. Lower SKUs or policy-based gateways do not support BGP routing.

6. Pick "Generation 2" for better performance and features.

7. Select your virtual network and ensure the subnet is set to "GatewaySubnet."

8. Create a new public IP address for the gateway. If you want high availability, enable "active-active mode" and create two public IP addresses.

9. Enable "Configure BGP ASN" and enter your chosen ASN, such as 65515.

10. Review your settings and click "Create." The deployment may take 45 minutes or more.

Note: Active-active mode gives you two gateway instances for higher uptime. Each instance gets its own BGP IP address.

BGP Parameters (ASN, Peer IP)

You must configure BGP parameters to enable dynamic route exchange between Azure and your on-premises network.

• Azure automatically assigns a BGP IP address from the GatewaySubnet. You cannot change this IP. You will use this address as the BGP peer IP on your on-premises device.

• In the Azure VPN Gateway settings, specify your ASN. This number must be different from the ASN used on your on-premises device.

• When you set up the Local Network Gateway (which represents your on-premises VPN device in Azure), enter the ASN and BGP peer IP address of your on-premises device. This allows Azure to establish a BGP session with your device.

Tip: Use APIPA addresses (169.254.x.x) for BGP peer IPs if your on-premises device requires it. Assign a /30 subnet for each BGP session, using the first usable IP for Azure and the second for your device. This setup prevents conflicts and supports multiple tunnels or active-active gateways.

You do not need to specify the on-premises address space in the Local Network Gateway when using BGP routing. BGP will handle route exchange automatically. Leaving the address space blank avoids confusion and routing conflicts.

Reminder: Always use IKEv2 for BGP-enabled VPN links. Disable policy-based traffic selectors to ensure stable BGP routing.

On-Premises BGP Configuration

Setting up your on-premises environment for BGP routing with Azure VPN Gateway involves three main steps. You must configure the Local Network Gateway in Azure, set up BGP on your VPN device, and verify your configuration with practical examples.

Local Network Gateway

The Local Network Gateway (LNG) in Azure represents your on-premises VPN device. You must configure it with the correct BGP settings to enable dynamic route exchange.

Follow these steps to set up the Local Network Gateway for BGP peering:

1. Open the Azure portal and navigate to your Local Network Gateway resource.

2. Select Configuration under the Settings menu.

3. Set Configure BGP settings to Yes.

4. Enter your on-premises ASN (Autonomous System Number). This ASN must differ from Azure's ASN and should not fall within the reserved Microsoft range (65515-65520).

5. Enter the BGP peer IP address. This address is the interface IP on your VPN device used for the tunnel. Use a /32 prefix to specify the exact host address.

6. Save your changes.

Tip: The BGP peer IP address must match the IP assigned to your VPN device's tunnel interface. If you use APIPA addresses (169.254.x.x), select an address from the Azure-reserved APIPA range (169.254.21.0 to 169.254.22.255).

You must also provide the address space for your on-premises network in the LNG. This step ensures Azure knows which routes to advertise.

Device BGP Setup

After configuring the Local Network Gateway, you need to set up BGP routing on your on-premises VPN device. The process varies by vendor, but the core requirements remain the same.

You must:

• Set your device's local ASN to match the ASN you entered in the Local Network Gateway.

• Assign the BGP peer IP address to the tunnel interface that connects to Azure.

• Add Azure's BGP peer IP address as a neighbor. Use Azure's ASN (default 65515 unless you changed it).

• Advertise your local networks so Azure can learn your routes.

Here is a general checklist for device setup:

• Configure the tunnel interface with the correct IP address and subnet (usually a /30 or /32).

• Enable BGP routing and set the router ID.

• Add a BGP neighbor entry for Azure's BGP peer IP and ASN.

• Allow BGP and VPN traffic through your firewall.

• Verify that your device supports IKEv2 and BGP.

Note: If you use APIPA addresses, your on-premises device must initiate the BGP session. Azure VPN Gateway does not start BGP peering when APIPA is used.

Example Configurations

You can use the following examples to guide your device setup. These examples show how to configure BGP routing on different platforms.

Cisco IOS Example

router bgp 65516
 bgp log-neighbor-changes
 neighbor 169.254.21.2 remote-as 65515
 neighbor 169.254.21.2 ebgp-multihop 2
 neighbor 169.254.21.2 update-source Tunnel0
 network 10.50.200.0 mask 255.255.255.0
!
interface Tunnel0
 ip address 169.254.21.1 255.255.255.252
 tunnel source GigabitEthernet0/0
 tunnel destination <Azure VPN Gateway Public IP>

Windows Server RRAS Example

# Install required features
Install-WindowsFeature RemoteAccess, Routing

# Add the VPN interface
Add-VpnS2SInterface -Name "AzureVPN" -Destination <Azure VPN Gateway Public IP> -Protocol IKEv2 -AuthenticationMethod PSK -SharedSecret "<YourPSK>" -IPv4Subnet <AzureSubnet>

# Configure BGP
Add-BgpRouter -BgpIdentifier <OnPremisesIP> -LocalASN 65516
Add-BgpPeer -Name "AzurePeer" -PeerIPAddress 169.254.21.2 -PeerASN 65515

Active-Active Gateway Considerations

Active-active Azure VPN Gateway deployments require special attention. Azure creates two gateway instances, each with its own public IP and BGP peer IP. Your on-premises device must support multiple tunnels and BGP neighbors.

Tip: BGP routing is highly recommended for active-active setups. It manages dynamic route changes and failover between tunnels automatically.

Downloadable Device Scripts

Azure provides downloadable configuration scripts for many popular VPN devices, including Cisco, Juniper, and Sophos. You can select your device model and firmware version in the Azure portal to get a tailored script. These scripts include the correct BGP parameters, tunnel settings, and routing commands.

Reminder: Always verify your configuration by checking BGP peers and learned routes in the Azure portal. Use monitoring tools to confirm that BGP routing works as expected.

Connections and Verification

Site-to-Site and VNet-to-VNet

You can set up both site-to-site and VNet-to-VNet connections with BGP routing enabled on Azure VPN Gateway. Follow these steps to ensure a successful configuration:

1. Create virtual networks for each site or region. Make sure the address spaces do not overlap.

2. Add a gateway subnet named "GatewaySubnet" to each virtual network. Use a /27 or larger subnet.

3. Deploy a VPN gateway in each virtual network. Choose the VPN type, select a SKU that supports BGP, and enable BGP during setup. If you need high availability, enable active-active mode.

4. After the gateways deploy, create connections:

   • For VNet-to-VNet, use the Azure portal if both VNets are in the same subscription. Use PowerShell or CLI for different subscriptions.

   • Choose the connection type: "VNet-to-VNet" or "Site-to-site (IPsec)."

   • Set a shared key (PSK) and use IKEv2 protocol.

   • For two-way communication, create connections in both directions or select the bidirectional option.

5. Check the connection status and data flow in the Azure portal.

Tip: Do not attach Network Security Groups to the gateway subnet. This can block VPN traffic and cause connection failures.

Verify BGP Routing

After you set up your connections, you need to confirm that BGP routing works as expected. You can check the VPN connection status in the Azure portal to see if the IPSec tunnel is connected. Review the effective routes in the route table for your VM’s network interface. This helps you confirm that the routes learned through BGP appear in the routing table. You can also use Azure CLI or PowerShell commands like Get-AzVirtualNetworkGatewayBgpPeerStatus to view BGP peer status and Get-AzVirtualNetworkGatewayLearnedRoute to see learned routes. These tools help you verify that your network exchanges routes correctly.

Troubleshooting

If you run into problems with BGP routing, start by checking these common issues:

• Make sure the ASN and BGP peer IP addresses match on both Azure and your on-premises device.

• Confirm that TCP port 179 is open and not blocked by any firewall.

• Check the BGP session state. Look for states like Idle, Connect, or Established to find where the session fails.

• Review logs for errors such as hold timer expiry or authentication failures.

• Use Azure Network Watcher to run connection tests and packet captures.

• If routes do not propagate, check for route filters or overlapping address spaces. Also, verify that NAT or firewall rules do not block traffic.

Note: Azure diagnostic logs and Network Watcher tools can help you trace and resolve complex connectivity issues.

---

You can set up secure and dynamic connections by following these steps:

1. Create the Azure VPN gateway with BGP enabled and set the ASN.

2. Configure the local network gateway with the correct ASN and BGP peer IP.

3. Establish site-to-site or VNet-to-VNet connections with BGP enabled.

4. Set up your on-premises device with matching BGP settings.

5. Check address spaces and enable BGP for transit routing if needed.

Dynamic routing lets your network adapt to changes and supports many topologies. You can use Azure Network Watcher to monitor BGP peer status and route changes. For advanced scenarios, explore Microsoft’s official documentation and community guides.

FAQ

What is the default ASN for Azure VPN Gateway?

Azure uses 65515 as the default ASN for VPN Gateway. You can change this value during gateway creation if you need a different ASN for your network design.

Can you use BGP with policy-based VPN gateways?

No, you cannot use BGP with policy-based VPN gateways. You must select a route-based VPN gateway to enable BGP routing in Azure.

How do you find the BGP peer IP address in Azure?

You can find the BGP peer IP address in the Azure portal. Go to your VPN Gateway resource, select "Configuration," and look under the BGP section. Azure assigns this IP automatically.

What happens if BGP routes do not appear in your VM’s route table?

Check your BGP session status first. Make sure the session is established. Review your address spaces for overlaps. Use Azure Network Watcher to see if routes are being learned and propagated.

Do you need to specify address spaces in the Local Network Gateway when using BGP?

No, you do not need to specify address spaces when using BGP. BGP automatically exchanges routes between Azure and your on-premises network, so you can leave the address space field blank.