# Redundant VPN to Microsoft Azure

> Отказоустойчивый VPN с двумя туннелями между VyOS и Azure VPN Gateway с active-active BGP - резервные IPsec-туннели и автоматический failover.

Source: https://opennix.org/docs/vyos/examples/vpn-azure-redundant/


Redundant Site-to-Site VPN с active-active tunnels и BGP для high availability между VyOS и Azure.

## Сценарий

- High Availability: Dual tunnel setup
- Active-Active: Оба туннеля передают трафик
- BGP: Automatic failover при отказе tunnel

## Топология

```
VyOS ═══ Tunnel 1 ═══► Azure GW Instance 0
     ═══ Tunnel 2 ═══► Azure GW Instance 1

BGP ECMP между двумя tunnels
```

## VyOS Configuration

```bash
# VTI 1 (к Azure Instance 0)
set interfaces vti vti1 address '10.10.255.1/30'

set vpn ipsec site-to-site peer 52.100.1.1 vti bind 'vti1'
set vpn ipsec site-to-site peer 52.100.1.1 authentication pre-shared-secret 'PSK1'

# VTI 2 (к Azure Instance 1)
set interfaces vti vti2 address '10.10.255.5/30'

set vpn ipsec site-to-site peer 52.100.1.2 vti bind 'vti2'
set vpn ipsec site-to-site peer 52.100.1.2 authentication pre-shared-secret 'PSK2'

# BGP
set protocols bgp system-as '65001'
set protocols bgp neighbor 10.10.255.2 remote-as '65515'
set protocols bgp neighbor 10.10.255.6 remote-as '65515'
```

## Azure Configuration

В Azure Portal:
1. Create VPN Gateway (Active-Active mode)
2. Два Local Network Gateways (VyOS IP)
3. Два connections с разными PSK
4. Enable BGP на Gateway

## Ссылки

- [Azure HA VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable)
- [VyOS BGP](https://docs.vyos.io/en/latest/configuration/protocols/bgp.html)