Home

Route Internet traffic through Ipsec tunnel.

%3CLINGO-SUB%20id%3D%22lingo-sub-613823%22%20slang%3D%22en-US%22%3ERoute%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-613823%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Everyone.%3C%2FP%3E%3CP%3EI%20need%20an%20architecture%20model%20for%20Routing%20internet%20traffic%20from%26nbsp%3B%20vnet%20A%20to%20Firewall%20which%20is%20in%20vnet%20B.%20Both%20vnets%20are%20in%20different%20region%20and%20connected%20by%20IPsec%20tunnel.%3C%2FP%3E%3CP%3EI%20have%20tried%20using%20two%20different%20UDR%20with%20below%20configurations%3A%3C%2FP%3E%3CP%3EUDR1%3A%3C%2FP%3E%3CP%3ESource%3A%20Subnet%201%20of%20vnet%20A%20%2C%20destination%3A%200.0.0.0%2F0%2C%20Next%20hop%3A%20VPN%20Gateway%20of%20vnet%20A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUDR2%3A%3C%2FP%3E%3CP%3Esource%3A%20Gateway%20subnet%20of%20vnet%20B%2C%26nbsp%3Bdestination%3A%200.0.0.0%2F0%2C%20Next%20hop%3A%20firewall%20private%20IP.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ebut%2C%20it%20doesn't%20seems%20to%20be%20good%20solution.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-613823%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ENetworking%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EVirtual%20Network%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-617788%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-617788%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3Ewhy%20do%20you%20want%20to%20route%20the%20traffic%20between%20two%20regions%20over%20a%20seperate%20Ipsec%20tunnel%20or%20VPN%20Gateway%3F%3CBR%20%2F%3EIt's%20possible%20to%20create%20a%20global%20VNet%20Peering.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fes-es%2Fblog%2Fglobal-vnet-peering-now-generally-available%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fes-es%2Fblog%2Fglobal-vnet-peering-now-generally-available%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EHannes%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-622012%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-622012%22%20slang%3D%22en-US%22%3E%3CP%3EThxx%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F289860%22%20target%3D%22_blank%22%3E%40Hannes_LG%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%3CP%3Ebut%20in%20my%20scenario%20we%20have%20already%20an%20existing%20infra%20and%20having%20multiple%20basic%20internal%20load%20balancer.%3C%2FP%3E%3CP%3EIf%20we%20go%20with%20global%20vnet%20peering%2C%20then%20we%20will%20have%20to%20update%20all%20basic%20internal%20load%20balancer%20to%20standard%20one%20because%20in%20global%20vnet%20peering%20we%20can't%20access%20frontend%20ip%20of%20internal%20load%20balancer%20of%20basic%20sku.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat's%20way%20I%E2%80%99m%20searching%20for%20another%20way.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-622021%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-622021%22%20slang%3D%22en-US%22%3E%3CBLOCKQUOTE%3E%3CHR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F289860%22%20target%3D%22_blank%22%3E%40Hannes_LG%3C%2FA%3E%26nbsp%3Bwrote%3A%3CBR%20%2F%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3Ewhy%20do%20you%20want%20to%20route%20the%20traffic%20between%20two%20regions%20over%20a%20seperate%20Ipsec%20tunnel%20or%20VPN%20Gateway%3F%3CBR%20%2F%3EIt's%20possible%20to%20create%20a%20global%20VNet%20Peering.%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fes-es%2Fblog%2Fglobal-vnet-peering-now-generally-available%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fes-es%2Fblog%2Fglobal-vnet-peering-now-generally-available%2F%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EHannes%3CHR%20%2F%3E%3C%2FBLOCKQUOTE%3E%3CP%3E%3CBR%20%2F%3EThxx%40Hannes_LG%26nbsp%3B%2C%3C%2FP%3E%3CP%3Ebut%20in%20my%20scenario%20we%20have%20already%20an%20existing%20infra%20and%20having%20multiple%20basic%20internal%20load%20balancer.%3C%2FP%3E%3CP%3EIf%20we%20go%20with%20global%20vnet%20peering%2C%20then%20we%20will%20have%20to%20update%20all%20basic%20internal%20load%20balancer%20to%20standard%20one%20because%20in%20global%20vnet%20peering%20we%20can't%20access%20frontend%20ip%20of%20internal%20load%20balancer%20of%20basic%20sku.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat's%20way%20I%E2%80%99m%20searching%20for%20another%20way.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-622025%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-622025%22%20slang%3D%22en-US%22%3E%3CP%3EThxx%40Hannes_LG%26nbsp%3B%2C%3C%2FP%3E%3CP%3Ebut%20in%20my%20scenario%20we%20have%20already%20an%20existing%20infra%20and%20having%20multiple%20basic%20internal%20load%20balancer.%3C%2FP%3E%3CP%3EIf%20we%20go%20with%20global%20vnet%20peering%2C%20then%20we%20will%20have%20to%20update%20all%20basic%20internal%20load%20balancer%20to%20standard%20one%20because%20in%20global%20vnet%20peering%20we%20can't%20access%20frontend%20ip%20of%20internal%20load%20balancer%20of%20basic%20sku%20in%20peered%20region.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fvirtual-networks-faq%23what-are-the-constraints-related-to-global-vnet-peering-and-load-balancers%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fvirtual-networks-faq%23what-are-the-constraints-related-to-global-vnet-peering-and-load-balancers%3C%2FA%3E%3C%2FP%3E%3CP%3EThat's%20way%20I%E2%80%99m%20searching%20for%20another%20way.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-623243%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-623243%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3Eokay%20that's%20bad.%20Is%20it%20possible%20to%20share%20your%20Route%20Table%3F%3CBR%20%2F%3ETo%20bin%20a%20UDR%20with%200.0.0.0%2F0%20to%20an%20Azure%20Gateway%20subnet%20isn't%20supported.%3CBR%20%2F%3E%3CBR%20%2F%3EOriginal%20Articel%20(%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fvirtual-networks-udr-overview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fvirtual-networks-udr-overview%3C%2FA%3E)%3CBR%20%2F%3E%3CBR%20%2F%3EIf%20your%20virtual%20network%20is%20connected%20to%20an%20Azure%20VPN%20gateway%2C%20do%20not%20associate%20a%20route%20table%20to%20the%20gateway%20subnet%20that%20includes%20a%20route%20with%20a%20destination%20of%200.0.0.0%2F0.%20Doing%20so%20can%20prevent%20the%20gateway%20from%20functioning%20properly.%20For%20details%2C%20see%20the%20Why%20are%20certain%20ports%20opened%20on%20my%20VPN%20gateway%3F%20question%20in%20the%20VPN%20Gateway%20FAQ.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20guess%20you%20have%20to%20define%20each%20subnet%20at%20the%20UDR.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EHannes%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-643556%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-643556%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F289860%22%20target%3D%22_blank%22%3E%40Hannes_LG%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3BI%20can't%20share%20much%20of%20info%2C%20but%20for%20your%20understanding%20I%20have%20already%20mentioned%20all%20the%20information%20in%20my%20question.%20For%20internal%20communication%20(private%20traffic)%2C%20traffic%20will%20go%20through%20IPsec%20tunnel.%20DMZ%20subnet%20is%20in%20vnet%20B%2C%20so%20we%20use%20UDR%20to%20route%26nbsp%3B%20all%20internet%20traffic%20from%20vnet%20B%20to%20firewall%20ip%20in%20DMZ%20subnet%20but%20for%20vnet%20A%20internet%20traffic%20i%20need%20your%20help.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-665564%22%20slang%3D%22en-US%22%3ERe%3A%20Route%20Internet%20traffic%20through%20Ipsec%20tunnel.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-665564%22%20slang%3D%22en-US%22%3EHi%2C%3CBR%20%2F%3E%3CBR%20%2F%3Esry%20for%20the%20late%20reply.%3CBR%20%2F%3ETo%20bind%20a%200.0.0.0%2F0%20route%20to%20a%20gateway%20subnet%20isn%E2%80%99t%20supported%20so%20please%20remove%20that%20one.%3CBR%20%2F%3EChange%20UDR1%3A%3CBR%20%2F%3E0.0.0.0%2F0%20next%20hop%20virtual%20appliance%20IP%3CBR%20%2F%3EBind%20to%20each%20subnet%20in%20vnet%20a%20(important%20not%20to%20the%20gateway%20subnet!)%3CBR%20%2F%3E%3CBR%20%2F%3EChange%20UDR2%3A%3CBR%20%2F%3E0.0.0.0%2F0%20next%20hob%20virtual%20appliance%20IP%3CBR%20%2F%3EBind%20to%20each%20subnet%20in%20vent%20b%20(important%20not%20to%20the%20gateway%20subnet!)%3CBR%20%2F%3E%3CBR%20%2F%3EOn%20Gateway%20in%20vnet%20a%20activate%20%E2%80%9Euse%20remote%20gateway%E2%80%9C%3CBR%20%2F%3EOn%20Gateway%20in%20vnet%20b%20activate%20%E2%80%9E%20gateway%20transit%E2%80%9C%3CBR%20%2F%3E%3CBR%20%2F%3EI%20guess%20that%20solution%20should%20fix%20your%20issue%20but%20I%20don%E2%80%99t%20have%20time%20(at%20the%20Moment)%20to%20test%20it.%3CBR%20%2F%3E%3CBR%20%2F%3ERegards%2C%3CBR%20%2F%3EHannes%3C%2FLINGO-BODY%3E
Highlighted
Deepak_kumar
Occasional Contributor

Hi Everyone.

I need an architecture model for Routing internet traffic from  vnet A to Firewall which is in vnet B. Both vnets are in different region and connected by IPsec tunnel.

I have tried using two different UDR with below configurations:

UDR1:

Source: Subnet 1 of vnet A , destination: 0.0.0.0/0, Next hop: VPN Gateway of vnet A

 

UDR2:

source: Gateway subnet of vnet B, destination: 0.0.0.0/0, Next hop: firewall private IP.

 

but, it doesn't seems to be good solution.

5 Replies
Hi,

why do you want to route the traffic between two regions over a seperate Ipsec tunnel or VPN Gateway?
It's possible to create a global VNet Peering.
https://azure.microsoft.com/es-es/blog/global-vnet-peering-now-generally-available/

Regards,
Hannes

Thxx@Hannes_LG ,

but in my scenario we have already an existing infra and having multiple basic internal load balancer.

If we go with global vnet peering, then we will have to update all basic internal load balancer to standard one because in global vnet peering we can't access frontend ip of internal load balancer of basic sku in peered region.

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#what-are-the-constraints...

That's way I’m searching for another way.

 

Hi,

okay that's bad. Is it possible to share your Route Table?
To bin a UDR with 0.0.0.0/0 to an Azure Gateway subnet isn't supported.

Original Articel (https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview)

If your virtual network is connected to an Azure VPN gateway, do not associate a route table to the gateway subnet that includes a route with a destination of 0.0.0.0/0. Doing so can prevent the gateway from functioning properly. For details, see the Why are certain ports opened on my VPN gateway? question in the VPN Gateway FAQ.

I guess you have to define each subnet at the UDR.

Regards,
Hannes

@Hannes_LG 

 

Hi,

 I can't share much of info, but for your understanding I have already mentioned all the information in my question. For internal communication (private traffic), traffic will go through IPsec tunnel. DMZ subnet is in vnet B, so we use UDR to route  all internet traffic from vnet B to firewall ip in DMZ subnet but for vnet A internet traffic i need your help.

Hi,

sry for the late reply.
To bind a 0.0.0.0/0 route to a gateway subnet isn’t supported so please remove that one.
Change UDR1:
0.0.0.0/0 next hop virtual appliance IP
Bind to each subnet in vnet a (important not to the gateway subnet!)

Change UDR2:
0.0.0.0/0 next hob virtual appliance IP
Bind to each subnet in vent b (important not to the gateway subnet!)

On Gateway in vnet a activate „use remote gateway“
On Gateway in vnet b activate „ gateway transit“

I guess that solution should fix your issue but I don’t have time (at the Moment) to test it.

Regards,
Hannes
Related Conversations