Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Image:https://www.mobilise.cloud/azure-to-aws-vpn-with-dynamic-routing/
Image:https://jackstromberg.com/2021/03/establishing-an-aws-vpn-tunnel-to-azure-virtual-wan-active-active-bpg-configuration/

In the previous post, I wrote about Static Site-to-Site VPN Between Azure Vnet and AWS VPC. In this post, I will write about dynamic VPN routing between Azure and AWS using BGP protocol.

Assuming all necessary resources such as, Vnet, VM, vWAN, VPC, Transit Gateway etc are already built, this post will only focus on the key configurations.

  1. Build Azure vWAN
  2. Provide vHub with VPN Gateway
  3. Configure Azure VPN Gateway’s custom BGP IP
  4. Create AWS Transit Gateway
  5. Create AWS Transit Gateway Attachment
  6. Create AWS Customer Gateway
  7. Apply route to VPC
  8. Create AWS VPN Connection
  9. Create new Azure VPN Site and connect
  10. Verify result

For Step 1 & 2, please refer Azure Virtual WAN with Secured Virtual Hub.

Since we are configuring both sides to communicate through BGP, therefore we must set BGP IP for both side.

On vHub page, click VPN then View/Configure.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Inside View/Configure, input your BGP IP Address. Copy the following as we will need it on later step.

  1. Azure AS Number
  2. VPN Public IP Address
  3. Custom BGP IP Address. In this demo, I use Instance 1.
Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

For APIPA, please visit here for more detail.

The most important parts of Transit Gateway are

  1. Amazon side ASN, default is 64512, you can leave it as it is or change to a number between 64512 to 65534.
  2. Transit Gateway CIDR blocks, you can leave it blank or give a CIDR block that is not in 169.254.0.0/16 and ranges overlap with addresses peered to Transit Gateway. For more information, please refer here.

Remember 64512 as we will use it at the last step. A finish view of the Transit Gateway.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

With Transit Gateway created, we now attach the VPCs we want it to peer with the Gateway. First choose the Transit Gateway.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Name your attachment and choose the which subnets are to be peered.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

A finish view of Transit Gateway Attachment.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

We copied two information on Step 3, now is the time to use them. Do not forget to choose Dynamic for your routing option.

IMPORTANT:Make sure BGP ASN is the same as Azure AS Number!

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

In order for VMs to communicate with each other, we need to set a routing rule directing traffics from EC2 to 10.0.0.0/16, Azure network, to go to Transit Gateway. Edit the route table that is associated with your VM VPC.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP
  • №1, Add all the destination network segment
  • №2, Choose the AWS Transit Gateway created

Create VPN Connection is the same concept from my previous post. The only difference is choose Transit Gateway rather than Virtual Private Gateway. Also, do not forget to choose Dynamic for Routing Options.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Next part is very important!

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP
  • For №1 and №2, since Dynamic routing will learn the routes itself, so we do not need to specify any CIDR here.
  • №3, the CIDR we configure on previous Step 3. In Step 3, we set the Custom BGP IP as 169.254.22.2. And since AWS only takes a /30 CIDR, so it has to be 169.254.22.0/30 and AWS will use the first IP, which is 22.1.
  • №4, Your secret word for VPN authentication.

Once done, grep the Public IP address of your AWS VPN Connection, as we will need it for next step.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

We are almost there. Now back to Azure, let’s create the VPN connection, start by clicking Create new VPN site.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

In the Basic tag, we can leave Private address space blank as we are using BGP.

In the Links tag, it is the most important part.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP
  • Link IP address is generate from last step.
  • 169.254.22.1 is the first IP of 169.254.22.0/30
  • 64512 is the AS number configured for AWS on Step 4

Once done, create the new VPN connection. Next, we connect to the VPN site.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Before we connect, there are some other information to be filled. Input the same magic word you input at Step 8.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

At this moment, VPN connection starts to establish between Azure and AWS. After a few minutes, you will see on Azure side, VPN connection is succeeded and connected.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

And on AWS side, you will see the status is up and 2 BGP ROUTES are learned.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Let’s check the routes on Azure side. We could see that traffics going to 172.31.0.0/16, which is AWS network segment, are sent to VPN Gateway.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Let’s check on AWS side. We could also see that traffics going to 10.0.0.0/16 are send to VPN Gateway as well.

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Lastly, has been a long way, we are finally here. Let’s verify the result from pinging VM on each other from both side.

  • My EC2’s private IP is 172.31.34.176
  • My Azure VM private IP is 10.0.0.4

EC2 ping Azure VM

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

Azure VM pinging EC2

Dynamic VPN Routing Between Azure Virtual WAN and AWS Transit Gateway using BGP

And test result is succeed! That’s it for today’s post. Hope you all like it. Have a good day.

Azure to AWS VPN with Dynamic Routing

Establishing an AWS VPN Tunnel to Azure Virtual WAN; Active/Active BPG Configuration

AWS Certified SA, SysOps & Developer Associate, Alibaba Cloud certified SA. Focusing on Azure, Prometheus w/ Grafana, ELK and K8S now.