Step-by-Step Guide: High available VNet-to-VNet connectivity via Active-Active Azure VPN gateways (PowerShell Guide)

There are two methods to connect two virtual networks.

1. Azure VPN Gateways
2. Azure VNET Peering

Azure VNET Peering
Azure VNET peering allows connecting virtual networks seamlessly via Azure backbone infrastructure. This is similar to inter-VLAN routing in on-premises networks. The traffic will not pass via the public internet. It provides low latency, high bandwidth connectivity between virtual networks. VNET peering can use to connect virtual networks in the same Azure region or different Azure regions.

Azure VPN Gateways
If we are connecting virtual networks over the internet, we have to use VPN gateway option. This is the same for connecting Azure networks with on-premises networks. Also, if the encryption is a requirement, we have to use VPN gateways. Azure VPN Gateways can use to connect,

• Virtual Networks in the same region
• Virtual Networks in different regions
• Virtual Networks in different subscriptions

If the connection is over the public internet, it is not possible to guarantee the uptime as it depends on many facts. By using Active-Active Azure VPN gateways to improve the high availability of the VNet-to-VNet connections. This is important if you connecting the virtual network between different Azure regions. We also can use Active-Active Azure VPN gateways with cross-premises VPN connections.

In Active-Active Azure VPN gateway setup,
• There are two Gateway IP configurations with two public IP addresses for one VPN gateway. This allows initiating full-mesh connectivity between two virtual networks.
• VPN gateway SKU must be VpnGw1, VpnGw2, VpnGw3, or HighPerformance
• Supported to use BGP

In this demo, I am going to demonstrate how we can establish VNet-to-VNet connectivity between two Azure regions via Active-Active Azure VPN gateways.

In this demo setup, I got two virtual networks in East US and UK South region. As shown above, I am going to establish a fully mesh connectivity between two virtual networks.
For the configuration process, I will be using PowerShell. Therefore, please make sure you have an Azure PowerShell module installed. More info about it can find under https://docs.microsoft.com/en-us/powershell/azure/install-az-ps?view=azps-3.8.0

Create Active-Active Azure VPN Gateway in East US

Create a resource group in East US

The first step of the configuration is to create a new resource group in East US.
To do that,
1. Launch PowerShell console and connect to Azure using Connect-AzAccount
2. Create a new resource group using New-AzResourceGroup -Name REBELRG1 -Location “East US”. Here REBELRG1 is RG group name and East US is the location.

Create a virtual network

The next step is to create a new virtual network under REBELRG1 resource group.

$subn1 = New-AzVirtualNetworkSubnetConfig -Name VMNet1 -AddressPrefix 10.0.0.0/24

$gwsubn1 = New-AzVirtualNetworkSubnetConfig -Name “GatewaySubnet” -AddressPrefix 10.0.255.0/27

New-AzVirtualNetwork -Name EUSVnet1 -ResourceGroupName REBELRG1 -Location “East US” -AddressPrefix 10.0.0.0/16 -Subnet $subn1,$gwsubn1

EUSVnet1 address space is 10.0.0.0/16. It is a class B IP address range. We do not need the entire range for workloads. Therefore, I am going to create two small subnets under it.

• VM Network – 10.0.0.0/24
• Gateway subnet – 10.0.255.0/27

In the above, VM network is going to use for virtual machines and Gateway Subnet is going to use for the VPN gateway setup.

Virtual Network Gateway can only be created in a subnet with name ‘GatewaySubnet’

Create two public IP addresses

For active-active VPN gateway, we need two public ip addresses. Let’s go ahead and create it using,

$gatewayip1 = New-AzPublicIpAddress -Name EUSVnet1GW1 -ResourceGroupName REBELRG1 -Location “East US” -AllocationMethod Dynamic

$gatewayip2 = New-AzPublicIpAddress -Name EUSVnet1GW2 -ResourceGroupName REBELRG1 -Location “East US” -AllocationMethod Dynamic

In the above, EUSVnet1GW1 & EUSVnet1GW2 are the new two public ip addresses. VPN Gateway only supports Dynamic Public IP address allocation.

Create Azure VPN gateway IP configurations

Before we create the gateway, we need to create ip configuration.

$vnet1 = Get-AzVirtualNetwork -Name EUSVnet1 -ResourceGroupName REBELRG1
$gwsubnet1 = Get-AzVirtualNetworkSubnetConfig -Name “GatewaySubnet” -VirtualNetwork $vnet1
$eusgw1ipconf1 = New-AzVirtualNetworkGatewayIpConfig -Name eusgw1ipconf1 -Subnet $gwsubnet1 -PublicIpAddress $gatewayip1
$eusgw1ipconf2 = New-AzVirtualNetworkGatewayIpConfig -Name eusgw1ipconf2 -Subnet $gwsubnet1 -PublicIpAddress $gatewayip2

In above, New-AzVirtualNetworkGatewayIpConfig command used to create an IP configuration for gateway (using previously created gateway subnet & public IP addresses)

Create active-active VPN Gateway

Finally, we can create the gateway using,

New-AzVirtualNetworkGateway -Name EUSGW1 -ResourceGroupName REBELRG1 -Location “East US” -IpConfigurations $eusgw1ipconf1,$eusgw1ipconf2 -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -EnableActiveActiveFeature -Debug

In the above, my new VPN gateway is called EUSGW1. I have enabled active-active mode using -EnableActiveActiveFeature. The gateway SKU is set to VpnGw1.

It can take around 45 minutes to complete VPN gateway setup.

According to configuration, we should see two public IP addresses associated with Azure VPN gateway. We can verify it using,

Get-AzPublicIpAddress -Name EUSVnet1GW1 -ResourceGroupName REBELRG1
Get-AzPublicIpAddress -Name EUSVnet1GW2 -ResourceGroupName REBELRG1

This completes the setup of active-active Azure VPN gateway in East US region.

Create Active-Active Azure VPN Gateway in UK South

Create a resource group in UK South

Let’s go ahead and create a new resource group in UK South region.

New-AzResourceGroup -Name REBELRG2 -Location “UK South”

In the above, REBELRG2 is the resource group names and it is created in UK South region.

Create a virtual network

The next step of the configuration is to create the new virtual network UKSVnet1. This VNet contains two subnets.

• VM Network – 10.1.0.0/24
• Gateway subnet – 10.1.255.0/27

In the above, VM network is going to use for virtual machines and Gateway Subnet is going to use for the VPN gateway setup.

Create two public IP addresses

Now we need to create two public IP addresses for the gateway.

$gatewayip3 = New-AzPublicIpAddress -Name UKSVnet1GW1 -ResourceGroupName REBELRG2 -Location “UK South” -AllocationMethod Dynamic
$gatewayip4 = New-AzPublicIpAddress -Name UKSVnet1GW2 -ResourceGroupName REBELRG2 -Location “UK South” -AllocationMethod Dynamic

In the above, UKSVnet1GW1 & UKSVnet1GW2 are the new two public ip addresses. VPN Gateway only supports Dynamic Public IP address allocation.

Create Azure VPN gateway IP configurations

As we did before, we also need to create ip configuration.

$vnet2 = Get-AzVirtualNetwork -Name UKSVnet1 -ResourceGroupName REBELRG2
$gwsubnet2 = Get-AzVirtualNetworkSubnetConfig -Name “GatewaySubnet” -VirtualNetwork $vnet2
$uksgw1ipconf1 = New-AzVirtualNetworkGatewayIpConfig -Name uksgw1ipconf1 -Subnet $gwsubnet2 -PublicIpAddress $gatewayip3
$uksgw1ipconf2 = New-AzVirtualNetworkGatewayIpConfig -Name uksgw1ipconf2 -Subnet $gwsubnet2 -PublicIpAddress $gatewayip4

In above, New-AzVirtualNetworkGatewayIpConfig command used to create an IP configuration for gateway (using previously created gateway subnet & public IP addresses)

Create active-active VPN Gateway

We can create VPN gateway by using,

New-AzVirtualNetworkGateway -Name UKSGW1 -ResourceGroupName REBELRG2 -Location “UK South” -IpConfigurations $uksgw1ipconf1,$uksgw1ipconf2 -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -EnableActiveActiveFeature -Debug

In the above, the new VPN gateway is called UKSGW1. I also enabled active-active mode using -EnableActiveActiveFeature. The gateway SKU is set to VpnGw1.

Once gateway setup is completed, let’s go ahead and verify the two gateway IP addresses using,

Get-AzPublicIpAddress -Name UKSVnet1GW1 -ResourceGroupName REBELRG2
Get-AzPublicIpAddress -Name UKSVnet1GW2 -ResourceGroupName REBELRG2

Establish connectivity between East US and UK South Gateways

Now we have fully working active-active gateways. The next step is to initiate connectivity between those. We can do it by using,

$eus1gw = Get-AzVirtualNetworkGateway -Name EUSGW1 -ResourceGroupName REBELRG1
$uks2gw = Get-AzVirtualNetworkGateway -Name UKSGW1 -ResourceGroupName REBELRG2
New-AzVirtualNetworkGatewayConnection -Name eus1gwtouks2gw -ResourceGroupName REBELRG1 -VirtualNetworkGateway1 $eus1gw -VirtualNetworkGateway2 $uks2gw -Location “East US” -ConnectionType Vnet2Vnet -SharedKey ‘Rebel123’
New-AzVirtualNetworkGatewayConnection -Name uks2gwtoeus1gw -ResourceGroupName REBELRG2 -VirtualNetworkGateway1 $uks2gw -VirtualNetworkGateway2 $eus1gw -Location “UK South” -ConnectionType Vnet2Vnet -SharedKey ‘Rebel123’

In the above, I am using the Vnet2Vnet connection type. I am also using pre-shared key ‘Rebel123’ to establish the connection. This can be changed to a value you required.

This establishes full-mesh connection between two VPN gateways. Let’s go ahead and verify the connection.

To verify the connection from EUSVnet1 to UKSVnet1, we can use the following command,

Get-AzVirtualNetworkGatewayConnection -Name eus1gwtouks2gw -ResourceGroupName REBELRG1

To verify the connection from UKSVnet1 to EUSVnet1 we can use,

Get-AzVirtualNetworkGatewayConnection -Name uks2gwtoeus1gw -ResourceGroupName REBELRG2

As we can see the connections are established successfully.

Testing

We can further verify this by using the following test.

I have a VM called REBELTVM01 in East US region. It is using EUSVnet1 virtual network and has private ip address 10.0.0.4 allocated.

I also have a VM called REBELTVM02 in UK South region. It is using UKSVnet1 virtual network and has private ip address 10.1.0.4 allocated.

If the connectivity works, I should be able to ping between these two servers by using private ip addresses.
From REBELTVM01 to REBELTVM02

From REBELTVM02 to REBELTVM01

As we can see, the connectivity between two virtual networks is working as expected. I hope now you have a better understanding of how to setup active-active VPN gateway between two VNets. This marks the end of this blog post. If you have any further questions feel free to contact me on rebeladm@live.com also follow me on twitter @rebeladm to get updates about new blog posts.