# Redundant VPN to Microsoft Azure

> Dual-tunnel HA VPN between VyOS and Azure VPN Gateway with active-active BGP - redundant IPsec tunnels, automatic failover, and routing configuration

Source: https://opennix.org/en/docs/vyos/examples/vpn-azure-redundant/


Redundant Site-to-Site VPN with active-active tunnels and BGP for high availability between VyOS and Azure.

## Scenario

- High Availability: Dual tunnel setup
- Active-Active: Both tunnels carry traffic
- BGP: Automatic failover on tunnel outage

## Topology

```
VyOS ═══ Tunnel 1 ═══► Azure GW Instance 0
     ═══ Tunnel 2 ═══► Azure GW Instance 1

BGP ECMP between the two tunnels
```

## VyOS Configuration

```bash
# VTI 1 (to Azure Instance 0)
set interfaces vti vti1 address '10.10.255.1/30'

set vpn ipsec site-to-site peer 52.100.1.1 vti bind 'vti1'
set vpn ipsec site-to-site peer 52.100.1.1 authentication pre-shared-secret 'PSK1'

# VTI 2 (to Azure Instance 1)
set interfaces vti vti2 address '10.10.255.5/30'

set vpn ipsec site-to-site peer 52.100.1.2 vti bind 'vti2'
set vpn ipsec site-to-site peer 52.100.1.2 authentication pre-shared-secret 'PSK2'

# BGP
set protocols bgp system-as '65001'
set protocols bgp neighbor 10.10.255.2 remote-as '65515'
set protocols bgp neighbor 10.10.255.6 remote-as '65515'
```

## Azure Configuration

In the Azure Portal:
1. Create VPN Gateway (Active-Active mode)
2. Two Local Network Gateways (VyOS IP)
3. Two connections with different PSKs
4. Enable BGP on the Gateway

## References

- [Azure HA VPN](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable)
- [VyOS BGP](https://docs.vyos.io/en/latest/configuration/protocols/bgp.html)