You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel.md
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ description: Learn how to use gateways with Windows 10 or later Always On to est
5
5
author: cherylmc
6
6
ms.service: azure-vpn-gateway
7
7
ms.topic: how-to
8
-
ms.date: 07/28/2023
8
+
ms.date: 12/13/2024
9
9
ms.author: cherylmc
10
10
11
11
---
@@ -27,7 +27,9 @@ Configure the VPN gateway to use IKEv2 and certificate-based authentication usin
27
27
28
28
To remove the profile, run the following command:
29
29
30
-
You can also set up your own custom APIPA addresses. AWS requires a /30 **Inside IPv4 CIDR** in the APIPA range of **169.254.0.0/16** for each tunnel. This CIDR must also be in the Azure-reserved APIPA range for VPN, which is from **169.254.21.0** to **169.254.22.255**. AWS will use the first IP address of your /30 inside CIDR and Azure will use the second. This means you need to reserve space for two IP addresses in your AWS /30 CIDR.
52
+
You can also set up your own custom APIPA addresses. AWS requires a /30 **Inside IPv4 CIDR** in the APIPA range of **169.254.0.0/16** for each tunnel. This CIDR must also be in the Azure-reserved APIPA range for VPN, which is from **169.254.21.0** to **169.254.22.255**. AWS uses the first IP address of your /30 inside CIDR and Azure uses the second. This means you need to reserve space for two IP addresses in your AWS /30 CIDR.
53
53
54
-
For example, if you set your AWS **Inside IPv4 CIDR** to be **169.254.21.0/30**, AWS will use the BGP IP address **169.254.21.1** and Azure will use the IP address **169.254.21.2**.
54
+
For example, if you set your AWS **Inside IPv4 CIDR** to be **169.254.21.0/30**, AWS uses the BGP IP address **169.254.21.1** and Azure uses the IP address **169.254.21.2**.
55
55
56
56
> [!IMPORTANT]
57
57
> * Your APIPA addresses must not overlap between the on-premises VPN devices and all connected Azure VPN gateways.
@@ -65,7 +65,9 @@ You must have both an Azure account and AWS account with an active subscription.
65
65
66
66
### Create a VNet
67
67
68
-
Create a virtual network with the following values. You can refer to the steps in the [Site-to-site Tutorial](tutorial-site-to-site-portal.md).
68
+
Create a virtual network. You can refer to the [Site-to-site Tutorial](tutorial-site-to-site-portal.md) for steps.
69
+
70
+
For this exercise, we use the following example values:
69
71
70
72
***Subscription**: If you have more than one subscription, verify that you're using the correct one.
71
73
***Resource group**: TestRG1
@@ -77,7 +79,9 @@ Create a virtual network with the following values. You can refer to the steps i
77
79
78
80
### Create an active-active VPN gateway with BGP
79
81
80
-
Create a VPN gateway using the following values:
82
+
In this section, you create active-active VPN gateway. You can refer to the [Site-to-site Tutorial](tutorial-site-to-site-portal.md) for steps.
83
+
84
+
For this exercise, we use the following example values:
81
85
82
86
***Name**: VNet1GW
83
87
***Region**: East US
@@ -94,29 +98,24 @@ Create a VPN gateway using the following values:
94
98
***SECOND PUBLIC IP ADDRESS**: Create new
95
99
***Public IP address 2 name**: VNet1GWpip2
96
100
***Availability zone**: Zone-redundant
97
-
***Configure BGP**: Enabled
98
-
***Autonomous system number (ASN)**: 65000
99
-
***Custom Azure APIPA BGP IP address**: 169.254.21.2, 169.254.22.2
100
-
***Second Custom Azure APIPA BGP IP address**: 169.254.21.6, 169.254.22.6
101
+
***BGP values**: When you configure BGP, pay attention to the following settings:
102
+
103
+
* Select **Enabled** for **Configure BGP** to show the BGP configuration section.
104
+
* Fill in a **ASN (Autonomous System Number)**. This ASN must be different than the ASN used by AWS.
101
105
102
-
1. In the Azure portal, navigate to the **Virtual network gateway** resource from the Marketplace, and select **Create**.
103
-
1. Fill in the parameters as shown in the following examples.
106
+
***Example:** 65000
104
107
105
-
:::image type="content" source="./media/vpn-gateway-howto-aws-bgp/gateway-basics.png" alt-text="Screenshot shows top part of the virtual network gateway screen." lightbox="./media/vpn-gateway-howto-aws-bgp/gateway-basics.png" :::
106
-
107
-
1. Configure both Public IP addresses and enable active-active mode. The public IP address objects created here are associated to the VPN gateway. The public IP address is dynamically assigned to the object when the VPN gateway is created.
108
+
* Add two addresses to **Custom Azure APIPA BGP IP address**. Include the IP addresses for **AWS Tunnel 1 to Azure Instance 0** and **AWS Tunnel 2 to Azure Instance 0** from the [APIPA configuration you chose](#apipa-config). The second input will only appear after you add your first APIPA BGP IP address.
* Add two addresses to **Second Custom Azure APIPA BGP IP address**. Include the IP addresses for **AWS Tunnel 1 to Azure Instance 1** and **AWS Tunnel 2 to Azure Instance 1** from the [APIPA configuration you chose](#apipa-config). The second input will only appear after you add your first APIPA BGP IP address.
* Select **Enabled** for **Configure BGP** to show the BGP configuration section.
116
-
* Fill in a **ASN (Autonomous System Number)**. This ASN must be different than the ASN used by AWS.
117
-
* Add two addresses to **Custom Azure APIPA BGP IP address**. Include the IP addresses for **AWS Tunnel 1 to Azure Instance 0** and **AWS Tunnel 2 to Azure Instance 0** from the [APIPA configuration you chose](#apipa-config). The second input will only appear after you add your first APIPA BGP IP address.
118
-
* Add two addresses to **Second Custom Azure APIPA BGP IP address**. Include the IP addresses for **AWS Tunnel 1 to Azure Instance 1** and **AWS Tunnel 2 to Azure Instance 1** from the [APIPA configuration you chose](#apipa-config). The second input will only appear after you add your first APIPA BGP IP address.
119
-
1. Select **Review + create** to run validation. Once validation passes, select **Create** to deploy the VPN gateway. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. You can see the deployment status on the Overview page for your gateway.
116
+
Select **Review + create** to run validation. Once validation passes, select **Create** to deploy the VPN gateway. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. You can see the deployment status on the **Overview** page for your gateway.
117
+
118
+
To view the public IP addresses that are assigned to your gateway, go to your virtual network gateway in the portal and navigate to **Settings -> Properties**.
120
119
121
120
## <aname ="part-2"></a> Part 2: Connect to your VPN gateway from AWS
122
121
@@ -220,16 +219,12 @@ Repeat these instructions to create each local network gateway.
220
219
1. Leave **IP Address** as the value for **Endpoint**.
221
220
1. For **IP Address**, enter the **Outside IP Address** (from AWS) for the tunnel you're creating.
222
221
1. Leave **Address Space** as blank and select **Advanced**.
1. On the **Advanced** tab, configure the following settings:
226
223
227
224
* Select **Yes** for **Configure BGP settings**.
228
225
* For **Autonomous system number (ASN)**, enter the ASN for your AWS Virtual Private Network. Use the ASN **64512** if you left your ASN as the AWS default value.
229
226
* For **BGP peer IP address**, enter the AWS BGP Peer IP Address based on the [APIPA configuration you chose](#apipa-config).
230
227
231
-
:::image type="content" source="./media/vpn-gateway-howto-aws-bgp/lng-bgp.png" alt-text="Screenshot shows values for your local network gateway BGP settings." :::
0 commit comments