You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/vpn-gateway/site-to-site-high-bandwidth-tunnel.md
+7-19Lines changed: 7 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,7 +12,7 @@ ms.date: 07/14/2025
12
12
---
13
13
14
14
# Create a Site-to-Site High Bandwidth tunnels in the Azure portal
15
-
The Azure VPN Gateway High Bandwidth tunnels feature, a part of the Advanaced Connectivity set of features, introduces significant improvements in tunnel throughput, enabling high-performance IPsec connections between the on-premises network and the Azure VNet. These High Bandwidth tunnels are established between a VPN device on-premises and the Azure VPN Gateway deployed in the Azure VNet, transiting through an ExpressRoute private peering. Utilizing private IP address networks on-premises, these tunnels create a secure overlay network between the on-premises infrastructure and the Azure VNet.
15
+
The Azure VPN Gateway High Bandwidth tunnels feature, a part of the Advanced Connectivity set of features, introduces significant improvements in tunnel throughput, enabling high-performance IPsec connections between the on-premises network and the Azure VNet. These High Bandwidth tunnels are established between a VPN device on-premises and the Azure VPN Gateway deployed in the Azure VNet, transiting through an ExpressRoute private peering. Utilizing private IP address networks on-premises, these tunnels create a secure overlay network between the on-premises infrastructure and the Azure VNet.
16
16
17
17
The High Bandwidth tunnels meet customer security compliance requirements by providing end-to-end encryption, effectively overcoming encryption bottlenecks. It allows for the establishment of four tunnels between the Azure VPN Gateway and the on-premises VPN device. The High Bandwidth tunnels allows the creation of two Connections with two IPsec tunnels for each Connection. Each IPsec tunnel can deliver a throughput of 5Gbps, achieving a total encrypted aggregate throughput of 20Gbps. The network diagram clarifies the configuration:
18
18
@@ -27,8 +27,8 @@ The full list of required objects are:
27
27
- ExpressRoute Direct Port
28
28
- ExpressRoute Circuit
29
29
- ExpressRoute Virtual Network Gateway
30
-
- Connection between the ExpressRoute circuit and the virtual network gateway WITH fastpath enabled.
31
-
- VPN Gateway of sku type VpnGw5AZ with Advanaced Connectivity enabled
30
+
- Connection between the ExpressRoute circuit and the virtual network gateway WITH FastPath enabled.
31
+
- VPN Gateway of sku type VpnGw5AZ with Advanced Connectivity enabled
32
32
- VPN Local Network Gateway
33
33
- User Defined Route (UDR) to push ER traffic to the VPN Gateway
34
34
@@ -41,7 +41,7 @@ The ExpressRoute Gateway can be only deployed in the GatewaySubnet. The ExpressR
41
41
![2]
42
42
43
43
## <aname="VNetGateway"></a>Create an ExpressRoute Connection
44
-
The ExpressRoute connection establishes a link between the ExpressRoute Gateway and the ExpressRoute circuit. The FastPath feature can be enabled in the ExpressRoute Connection by the following powershell command:
44
+
The ExpressRoute connection establishes a link between the ExpressRoute Gateway and the ExpressRoute circuit. The FastPath feature can be enabled in the ExpressRoute Connection by the following PowerShell command:
45
45
46
46
```powershell
47
47
Connect-AzAccount
@@ -68,7 +68,7 @@ At this stage of deployment, the Azure VNet is connected to the on-premises netw
68
68
## <aname="on-premises network"></a>Advertisement of the on-premises network to the ExpressRoute circuit
69
69
IPsec tunnels are established via transit through ExpressRoute private peering. To enable these tunnels, the private IP addresses of the on-premises VPN devices must be advertised from the customer’s edge routers to the Microsoft Enterprise Edge (MSEE) routers. If other on-prem networks are advertised to ExpressRoute, this runs the risk of "leaking" these routes to the VNet which could bypass the VPN Gateway and traffic could go directly to the ExpressRoute gateway, bypassing encryption. So it's important to only advertise the VPN Device tunnel IPs over ExpressRoute.
70
70
71
-
The routes between the VPN Device and the VPN Gateway should contain the detailed on-prem networks, this can be via static routes or BGP, but keep your on-prem networks in this routeing "channel" to ensure Azure traffic to on-prem is encrypted before entering the ExpressRoute data path (insdide the VPN tunnel).
71
+
The routes between the VPN Device and the VPN Gateway should contain the detailed on-prem networks, this can be via static routes or BGP, but keep your on-prem networks in this routeing "channel" to ensure Azure traffic to on-prem is encrypted before entering the ExpressRoute data path (inside the VPN tunnel).
72
72
73
73
If you do add routes to ExpressRoute that you wish to encrypt, a UDR will be needed on the VNets pointing to the VPN Gateway as the next hop to ensure that traffic is put into the encrypted tunnel before transiting ExpressRoute.
74
74
@@ -102,7 +102,7 @@ In the Azure portal:
102
102
103
103
> [!NOTE]
104
104
> To select the High Bandwidth VPN Gateway in the Azure portal, enable the **Enable Advanced Connectivity** property during gateway creation. When this option is selected, Azure automatically configures the gateway in active-active mode.
105
-
> High Banwidth tunnels can be deployed with static routing or BGP. The High Bandwidth tunnels is supported only in VPN Gateway route-based.
105
+
> High Bandwidth tunnels can be deployed with static routing or BGP. The High Bandwidth tunnels is supported only in VPN Gateway route-based.
106
106
107
107
A gateway can take 45 minutes or more to fully create and deploy. You can see the deployment status on the **Overview** page for your gateway.
108
108
@@ -270,7 +270,7 @@ For more information about VPN Gateway, see the [VPN Gateway FAQ](vpn-gateway-vp
270
270
[3]: ./media/site-to-site-high-bandwidth-tunnel/expressroute-connection-fastpath.png"ExpressRoute Connection with FastPath enabled"
271
271
[4]: ./media/site-to-site-high-bandwidth-tunnel/vpn-gw-hb.png"VPN Gateway High Bandwidth tunnels"
272
272
[5]: ./media/site-to-site-high-bandwidth-tunnel/vpn-gw-hb2.png"VPN Gateway High Bandwidth tunnels"
0 commit comments