Skip to content

Latest commit

 

History

History
128 lines (94 loc) · 4.92 KB

azure-vpn-bgp.rst

File metadata and controls

128 lines (94 loc) · 4.92 KB
Raw

Route-Based Site-to-Site VPN to Azure (BGP over IKEv2/IPsec)

This guide shows an example of a route-based IKEv2 site-to-site VPN to Azure using VTI and BGP for dynamic routing updates.

Prerequisites

  • A pair of Azure VNet Gateways deployed in active-passive configuration with BGP enabled.
  • A local network gateway deployed in Azure representing the Vyos device, matching the below Vyos settings except for address space, which only requires the Vyos private IP, in this example 10.10.0.5/32
  • A connection resource deployed in Azure linking the Azure VNet gateway and the local network gateway representing the Vyos device.

Example

WAN Interface eth0
On-premises address space 10.10.0.0/16
Azure address space

10.0.0.0/16
Vyos public IP 198.51.100.3
Vyos private IP 10.10.0.5
Azure VNet Gateway public IP

203.0.113.2
Azure VNet Gateway BGP IP

10.0.0.4
Pre-shared key ch00s3-4-s3cur3-psk
Vyos ASN 64499
Azure ASN 65540

Vyos configuration

  • Configure the IKE and ESP settings to match a subset of those supported by Azure:
set vpn ipsec esp-group AZURE compression 'disable'
set vpn ipsec esp-group AZURE lifetime '3600'
set vpn ipsec esp-group AZURE mode 'tunnel'
set vpn ipsec esp-group AZURE pfs 'dh-group2'
set vpn ipsec esp-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec esp-group AZURE proposal 1 hash 'sha1'

set vpn ipsec ike-group AZURE dead-peer-detection action 'restart'
set vpn ipsec ike-group AZURE dead-peer-detection interval '15'
set vpn ipsec ike-group AZURE dead-peer-detection timeout '30'
set vpn ipsec ike-group AZURE ikev2-reauth 'yes'
set vpn ipsec ike-group AZURE key-exchange 'ikev2'
set vpn ipsec ike-group AZURE lifetime '28800'
set vpn ipsec ike-group AZURE proposal 1 dh-group '2'
set vpn ipsec ike-group AZURE proposal 1 encryption 'aes256'
set vpn ipsec ike-group AZURE proposal 1 hash 'sha1'
  • Enable IPsec on eth0
set vpn ipsec ipsec-interfaces interface 'eth0'
  • Configure a VTI with a dummy IP address
set interfaces vti vti1 address '10.10.1.5/32'
set interfaces vti vti1 description 'Azure Tunnel'
  • Clamp the VTI's MSS to 1350 to avoid PMTU blackholes.
set firewall options interface vti1 adjust-mss 1350
  • Configure the VPN tunnel
set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
  • Important: Add an interface route to reach Azure's BGP listener
set protocols static interface-route 10.0.0.4/32 next-hop-interface vti1
  • Configure your BGP settings
set protocols bgp 64499 neighbor 10.0.0.4 remote-as '65540'
set protocols bgp 64499 neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration 'inbound'
set protocols bgp 64499 neighbor 10.0.0.4 timers holdtime '30'
set protocols bgp 64499 neighbor 10.0.0.4 timers keepalive '10'
  • Important: Disable connected check
set protocols bgp 64499 neighbor 10.0.0.4 disable-connected-check