I need guidance on configuring a resilient site-to-site VPN between an on-premises Meraki MX68 and Azure. The MX68 has two Internet connections, WAN1 and WAN2. I want the VPN to remain connected through WAN2 if WAN1 fails.
I have previously configured an Azure site-to-site VPN using one Internet connection, but the dual-WAN design is more complicated. On the Azure side, I currently have a VpnGw2AZ VPN gateway configured for active-active operation with BGP enabled, along with two public IP addresses.
My current plan is to create two Local Network Gateways, each using one of the Meraki WAN public IPs, and then create two VPN connections to the Azure gateway. I am having trouble understanding the BGP requirements and getting all of the settings to save correctly. Is this the right architecture, or would there be a better approach for providing failover between the two WAN circuits?
2 Answers
You’re generally on the right track, but a fully redundant design normally uses four tunnels: two from the primary WAN to both Azure active-active gateway instances, and two from the secondary WAN to both gateway instances.
BGP is then used to control path preference. Set the on-premises routing preference so the primary WAN is preferred for outbound traffic. For routes advertised through the secondary WAN, prepend an extra AS path so Azure prefers the primary-WAN tunnels for return traffic as well. This assumes the Azure gateway is using AS-path length when selecting the preferred route.
The tricky part is less the tunnel creation and more understanding how BGP affects routing in both directions. Azure Virtual WAN can simplify much of this design, although it adds service costs.
Virtual WAN is worth considering for a production deployment with redundant connectivity. It is designed to make branch-to-Azure connectivity and routing easier to manage, and it can handle scenarios that would otherwise require several tunnels and more detailed BGP configuration.
The tradeoff is cost and architecture: it is a paid service, unlike using a regular virtual network and VPN gateway directly. The best choice also depends on whether you have one region or several, how many VNets are involved, and whether an Azure Firewall or other transit services are part of the design.
Thanks, I’ll look into Virtual WAN and compare it with managing the redundant tunnels directly.
Would Azure Virtual WAN be the service you mean for simplifying this design?