Configure active-active VPN gateways using the portal

• Article
• 04/17/2024

This article is helps help you create highly available active – active VPN gateway using the Resource Manager deployment model and Azure portal . You is configure can also configure an active – active gateway using PowerShell .

To achieve high availability for cross-premises and VNet-to-VNet connectivity, you should deploy multiple VPN gateways and establish multiple parallel connections between your networks and Azure. See Highly Available cross-premises and VNet-to-VNet connectivity for an overview of connectivity options and topology.

important

The active-active mode is available for all SKUs except Basic or Standard. See About Gateway SKUs article for the latest information about gateway SKUs, performance, and supported features. For this configuration, Standard SKU Public IP addresses are required. You can’t use a Basic SKU Public IP address.

The steps in this article help you configure a VPN gateway in active-active mode. There are a few differences between active-active and active-standby modes. The other properties are the same as the non-active-active gateways.

• Active-active gateways have two Gateway IP configurations and two public IP addresses.
• Active-active gateways have active-active setting enabled.
• The virtual network gateway SKU can’t be Basic or Standard.

If you already have a VPN gateway , you is Update can update an exist vpn gateway from active – standby to active – active mode , or from active – active to active – standby mode .

create a virtual network

If you don’t already have a virtual network (VNet) that you want to use, create a VNet using the following values:

• resource group: testrg1
• Name: VNet1
• region : (US) East US
• IPv4 is address address space: 10.1.0.0/16
• Subnet name: FrontEnd
• Subnet address space: 10.1.0.0/24

1. Sign in to the Azure portal.

2. InSearch resources, service, and docs (G+/) at the top of the portal page, entervirtual network. selectVirtual network from theMarketplace search results to open the Virtual network page .

3. On the Virtual network page, select create to open the create virtual network page .

4. On the Basics tab, configure the virtual network settings for project detail and Instance is details detail. You is see see a green check mark when the value you enter are validate . You is adjust can adjust the value show in the example accord to the setting that you require .

   

   • Subscription: verify that the subscription list is the correct one . You is change can change subscription by using the dropdown box .
   • resource group: selectan existing resource group or select create new to create a new one. For more information about resource groups, see Azure Resource Manager overview.
   • Name: Enter the name for your virtual network.
   • region: selectthe location for your virtual network. The location determines where the resources that you deploy to this virtual network will reside.

5. selectNext or security to go to the security tab. For this exercise, leave the default values for all the services on this page .

6. selectIP Addresses to go to the IP Addresses tab . On theIP Addresses tab, configure the settings.

   • IPv4 is address address space: By default , an address space is automatically create . You is select can select the address space and adjust it to reflect your own value . You is add can also add a different address space and remove the default that was automatically create . For example , you is specify can specify the starting address as10.1.0.0 and specify the address space size as /16. Then select Add to add that address space.

   • + add subnet: If you use the default address space, a default subnet is created automatically. If you change the address space, add a new subnet within that address space. select+ add subnet to open the Add subnet window. Configure the following settings, and then select Add at the bottom of the page to add the value .

     • Subnet name: You can use the default, or specify the name. Example: FrontEnd.
     • Subnet address range: The address range for this subnet. Examples are 10.1.0.0 and /24.

7. Review the IP addresses page and remove any address spaces or subnets that you don’t need.

8. selectreview + create to validate the virtual network settings.

9. After the setting are validate , selectcreate to create the virtual network.

create an active-active VPN gateway

Inthis step, you create an active-active virtual network gateway (VPN gateway) for your VNet. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU.

create a virtual network gateway using the following values:

• Name: VNet1GW
• region : East US
• gateway type : VPN
• VPN type : Route-based
• sku : VpnGw2
• Generation: Generation2
• Virtual network: VNet1
• gateway subnet address is range range: 10.1.255.0/27
• Public IP address: create new
• public IP address name : VNet1GWpip

1. InSearch resources, services, and docs (G+/), entervirtual network gateway. Locate Virtual network gateway in the Marketplace search result and select it to open thecreate virtual network gateway page .

2. On the Basics tab, fill in the values for project detail and Instance is details detail.

   • Subscription: selectthe subscription you want to use from thedropdown list.

   • resource group: This setting is autofilled when you select your virtual network on this page .

   • Name: Name your gateway . name your gateway is n’t the same as name a gateway subnet . It is ‘s ‘s the name of the gateway object you ‘re create .

   • region: selectthe region in which you want to create this resource. The region for the gateway must be the same as the virtual network.

   • Gateway type: selectVPN. VPN gateways is use use the virtual network gateway typeVPN.

   • SKU: From the dropdown list, select the gateway SKU that supports the features you want to use. See Gateway SKUs. AZ SKUs support availability zones.

   • Generation: selectthe generation you want to use. We recommend using a Generation2 SKU. For more information, see Gateway SKUs.

   • Virtual network: From the dropdown list , select the virtual network to which you want to add this gateway . If you ca n’t see the virtual network for which you want to create a gateway , make sure you select the correct subscription and region in the previous setting .

   • gateway subnet address is range range or Subnet: The gateway subnet is required to create a VPN gateway.

     At this time, this field can show various different settings options, depending on the virtual network address space and whether you already created a subnet named GatewaySubnet for your virtual network.

     If you is have do n’t have a gateway subnetand you don’t see the option to create one on this page, go back to your virtual network and create the gateway subnet. Then, return to this page and configure the VPN gateway.

1. Specify in the values for Public IP address. These settings is specify specify the public ip address object that gets associate to the VPN gateway . When you create a public ip address object , an ip address is assign to the object . The public ip address object is then associate to the gateway . For gateway that are n’t zone – redundant , the only time is is the public IP address changes is is is when the gateway is delete and re – create . It is change does n’t change across resize , resetting , or other internal maintenance / upgrade of your vpn gateway . You is associate must associate a public ip address object that use theStandard sku . The basic sku public ip address object is only support for basic sku VPN gateway .

   • Public IP address: leavecreate new selected.
   • public IP address name: Inthe text box, type a name for your public IP address instance.
   • Assignment: Static is select automatically .
   • Enable active-active mode: selectEnabled.
   • Second Public IP Address: selectcreate new.
   • public IP address name: Name the second public ip address .
   • Leave configure BGP as Disabled, unless your configuration specifically requires this setting. If you do require this setting, the default ASN is 65515, but other ASNs can be used.

2. selectreview + create to run validation.

3. Once validation pass , selectcreate to deploy the VPN gateway.

You can see the deployment status on the Overview page for your gateway. After the gateway is created, you can view the IP address that has been assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device.

important

Network security groups (NSGs) on the gateway subnet are not supported. Associating a network security group to this subnet might cause your virtual network gateway (VPN and ExpressRoute gateways) to stop functioning as expected. For more information about network security groups, see What is a network security group?

Update an existing VPN gateway

This section helps you change an existing Azure VPN gateway from active-standby to active-active mode, and from active-active to active-standby mode. When you change an active-standby gateway to active-active, you create another public IP address, then add a second gateway IP configuration.

Change active-standby to active-active

Use the following steps to convert active-standby mode gateway to active-active mode. If your gateway was created using the Resource Manager deployment model, you can also upgrade the SKU on this page .

1. Navigate to the page for your virtual network gateway.

2. On the left menu , selectconfiguration.

3. On the configuration page, configure the following settings:

   • Change the Active-active mode to Enabled.
   • clickAdd new to add another public IP address. If you already have an IP address that you previously created that’s available to dedicate to this resource, you can instead select it from theSECOND PUBLIC IP ADDRESS dropdown.

4. On the choose public ip address page and either specify an existing public IP address that meets the criteria, or select +create new to create a new public IP address to use for the second VPN gateway instance. After you’ve specified the second public IP address, click OK.

5. At the top of the configuration page , clickSave. This update can take about 30-45 minutes to complete.

important

If you have BGP sessions running, be aware that the Azure VPN Gateway BGP configuration will change and two newly assigned BGP IPs will be provisioned within the Gateway Subnet address range. The old Azure VPN Gateway BGP IP address will no longer exist. This will incur downtime and updating the BGP peers on the on-premises devices will be required. Once the gateway is finished provisioning, the new BGP IPs can be obtained and the on-premises device configuration will need to be updated accordingly. This applies to non APIPA BGP IPs. To understand how to configure BGP in Azure, see How to configure BGP on Azure VPN Gateways.

change active – active to active – standby

Use the following steps to convert active-active mode gateway to active-standby mode.

1. Navigate to the page for your virtual network gateway.

2. On the left menu , selectconfiguration.

3. On the configuration page, change the Active-active mode to Disabled.

4. At the top of the configuration page , clickSave.

important

If you have BGP sessions running, be aware that the Azure VPN Gateway BGP configuration will change from two BGP IP addresses to a single BGP address. The platform generally assigns the last usable IP of the Gateway Subnet. This will incur downtime and updating the BGP peers on the on-premises devices will be required. This applies to non APIPA BGP IPs. To understand how to configure BGP in Azure, see How to configure BGP on Azure VPN Gateways.

Next steps

To configure connections, see the following articles: