Документация
Документация VyOS
Configuration Examples - Примеры конфигурации VyOS
Redundant VPN to Microsoft Azure

Redundant VPN to Microsoft Azure

Redundant Site-to-Site VPN с active-active tunnels и BGP для high availability между VyOS и Azure.

Сценарий

  • High Availability: Dual tunnel setup
  • Active-Active: Оба туннеля передают трафик
  • BGP: Automatic failover при отказе tunnel

Топология 

VyOS ═══ Tunnel 1 ═══► Azure GW Instance 0
     ═══ Tunnel 2 ═══► Azure GW Instance 1

BGP ECMP между двумя tunnels

VyOS Configuration 

# VTI 1 (к Azure Instance 0)
set interfaces vti vti1 address '10.10.255.1/30'

set vpn ipsec site-to-site peer 52.100.1.1 vti bind 'vti1'
set vpn ipsec site-to-site peer 52.100.1.1 authentication pre-shared-secret 'PSK1'

# VTI 2 (к Azure Instance 1)
set interfaces vti vti2 address '10.10.255.5/30'

set vpn ipsec site-to-site peer 52.100.1.2 vti bind 'vti2'
set vpn ipsec site-to-site peer 52.100.1.2 authentication pre-shared-secret 'PSK2'

# BGP
set protocols bgp system-as '65001'
set protocols bgp neighbor 10.10.255.2 remote-as '65515'
set protocols bgp neighbor 10.10.255.6 remote-as '65515'

Azure Configuration

В Azure Portal:

  1. Create VPN Gateway (Active-Active mode)
  2. Два Local Network Gateways (VyOS IP)
  3. Два connections с разными PSK
  4. Enable BGP на Gateway

Ссылки

Tunnelbroker.net - IPv6 Connectivity через Hurricane ElectricPolicy-Based IPsec VPN to Cisco ASA