You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/expressroute/using-s2s-vpn-as-a-backup-for-expressroute-privatepeering.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.author: rambala
15
15
16
16
In the article titled [Designing for disaster recovery with ExpressRoute private peering][DR-PP], we discussed the need for backup connectivity solution for an ExpressRoute private peering connectivity and how to use geo-redundant ExpressRoute circuits for the purpose. In this article, let us consider how to leverage and maintain site-to-site (S2S) VPN as a back for ExpressRoute private peering.
17
17
18
-
Unlike geo-redundant ExpressRoute circuits, you can use ExpressRoute-VPN disaster recover combination only in active-passive mode. A major challenge of using any backup network connectivity in the passive mode is that the passive connection would often fail alongside the primary connection. The common reason for the backup failure is lack of active maintenance of the passive connection. Therefore, in this article let's focus on how to verify and actively maintain S2S VPN connectivity that is backing up an ExpressRoute private peering.
18
+
Unlike geo-redundant ExpressRoute circuits, you can use ExpressRoute-VPN disaster recovery combination only in active-passive mode. A major challenge of using any backup network connectivity in the passive mode is that the passive connection would often fail alongside the primary connection. The common reason for the failures of the passive connection is lack of active maintenance. Therefore, in this article let's focus on how to verify and actively maintain S2S VPN connectivity that is backing up an ExpressRoute private peering.
19
19
20
20
>[!NOTE]
21
21
>When a given route is advertised via both ExpressRoute and VPN, Azure would prefer routing over ExpressRoute.
@@ -37,14 +37,14 @@ The following table lists the key IP prefixes of the topology:
| VPN gateway primary BGP peer IP | 10.17.11.76/32|
46
-
| VPN gateway secondary BGP peer IP | 10.17.11.77/32|
47
-
| On-premises firewall VPN BGP peer IP | 192.168.11.88/32|
45
+
| VPN gateway primary BGP peer IP | 10.17.11.76 |
46
+
| VPN gateway secondary BGP peer IP | 10.17.11.77 |
47
+
| On-premises firewall VPN BGP peer IP | 192.168.11.88 |
48
48
| Primary CE router i/f towards firewall IP | 192.168.11.0/31 |
49
49
| Firewall i/f towards primary CE router IP | 192.168.11.1/31 |
50
50
| Secondary CE router i/f towards firewall IP | 192.168.11.2/31 |
@@ -231,10 +231,10 @@ Failure to see route exchanges indicate connection failure. See [Troubleshooting
231
231
Now that we have confirmed successful route exchanges over the VPN connection (control plane), we are set to switch traffic (data plane) from the ExpressRoute connectivity to the VPN connectivity.
232
232
233
233
>[!NOTE]
234
-
>In production environments failover testing has to be done during well notified network maintenance work-windows as they can be service disruptive.
234
+
>In production environments failover testing has to be done during scheduled network maintenance work-window as it can be service disruptive.
235
235
>
236
236
237
-
Prior to do the traffic switch, let's trace route the current path in our setup from an on-premises server and a VM in the spoke VNet.
237
+
Prior to do the traffic switch, let's trace route the current path in our setup from the on-premises test server to the test VM in the spoke VNet.
238
238
239
239
C:\Users\PathLabUser>tracert 10.17.11.132
240
240
@@ -268,7 +268,7 @@ The failover switch time depends on the BGP convergence time. In our setup, the
268
268
269
269
Trace complete.
270
270
271
-
The traceroute result confirms that the backup connection via S2S VPN is active and can provide service continuity if both the primary and secondary ExpressRoute connections fail. To complete the failover testing, let's enable the ExpressRoute connections back and normalize, using the following set of commands.
271
+
The traceroute result confirms that the backup connection via S2S VPN is active and can provide service continuity if both the primary and secondary ExpressRoute connections fail. To complete the failover testing, let's enable the ExpressRoute connections back and normalize the traffic flow, using the following set of commands.
0 commit comments