Documentation
VyOS Documentation
VyOS Configuration Examples
Redundant VPN to Microsoft Azure

Redundant VPN to Microsoft Azure

Redundant Site-to-Site VPN with active-active tunnels and BGP for high availability between VyOS and Azure.

Scenario

  • High Availability: Dual tunnel setup
  • Active-Active: Both tunnels carry traffic
  • BGP: Automatic failover on tunnel outage

Topology

VyOS ═══ Tunnel 1 ═══► Azure GW Instance 0
     ═══ Tunnel 2 ═══► Azure GW Instance 1

BGP ECMP between the two tunnels

VyOS Configuration

# VTI 1 (to Azure Instance 0)
set interfaces vti vti1 address '10.10.255.1/30'

set vpn ipsec site-to-site peer 52.100.1.1 vti bind 'vti1'
set vpn ipsec site-to-site peer 52.100.1.1 authentication pre-shared-secret 'PSK1'

# VTI 2 (to Azure Instance 1)
set interfaces vti vti2 address '10.10.255.5/30'

set vpn ipsec site-to-site peer 52.100.1.2 vti bind 'vti2'
set vpn ipsec site-to-site peer 52.100.1.2 authentication pre-shared-secret 'PSK2'

# BGP
set protocols bgp system-as '65001'
set protocols bgp neighbor 10.10.255.2 remote-as '65515'
set protocols bgp neighbor 10.10.255.6 remote-as '65515'

Azure Configuration

In the Azure Portal:

  1. Create VPN Gateway (Active-Active mode)
  2. Two Local Network Gateways (VyOS IP)
  3. Two connections with different PSKs
  4. Enable BGP on the Gateway

References

Reviewed by OpenNix LLC · Last updated on
Tunnelbroker.net - IPv6 via Hurricane ElectricPolicy-Based IPsec VPN to Cisco ASA