Azure VPN Gateway
An Azure service that enables the connection of on-premises networks to Azure through site-to-site virtual private networks.
1,678 questions
Local Network gateway BGP
Handian Sudianto
5,776
Reputation points
Hello,
I have topology like below where i set VGW as active active for redudancy.
With this topology should i define the LAN address 10.107.0.0/16 and 10.210.0.107 in LNG1 and 10.107.0.0/16 and 10.210.0.207 in LNG2? Or we let the address space to be blank?
Also in the on-premises firewall i advertise network 10.107.0.0/16, will prefix 10.107.0.0/16 which received by 10.201.0.4 will be advertise to 10.201.0.5 and 10.201.0.5 will advertise again to 10.210.0.207? So i will receive prefix 10.107.0.0/16 on my peer 10.210.0.27
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 0%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESW%3C/text%3E%3C/svg%3E)
Silvia Wibowo 5,441 Reputation points Microsoft Employee2025-03-10T06:04:03.5766667+00:00 Hi @Handian Sudianto , please clarify:
- Is BGP enabled? If BGP is enabled, no address space is required for Local Network Gateway.
- If you use BGP, do you use APIPA (Automatic Private IP Addressing)? If APIPA is used, you need to set APIPA BGP IP address properly for both sides (Azure and on-premises).
-
Handian Sudianto 5,776 Reputation points
2025-03-11T05:42:29.7633333+00:00 is there any impact if we set or unset the address space?
-
Silvia Wibowo 5,441 Reputation points Microsoft Employee
2025-03-11T20:48:27.68+00:00 Hi @Handian Sudianto , the address space is required if BGP is not enabled, as it will give the VPN Gateway info for the routing. If BGP is enabled, BGP will set the routing and the address space is not looked at.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 81%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Sai Prasanna Sinde 4,335 Reputation points Microsoft External Staff2025-03-12T01:12:34.48+00:00 If BGP is correctly configured, Azure will learn the routes from your on-premises firewall via BGP. Leaving the address space blank keeps the configuration clean and avoids potential conflicts and in most BGP-based VPN setups, leaving the address space blank is the best practice.
Please refer this document.
If you correctly specify the on-premises networks, it won't break anything. However, it's redundant and adds unnecessary configuration but if you specify incorrect or incomplete address spaces, it could lead to confusion and troubleshooting difficulties.
Azure might prioritize the static address spaces over the dynamically learned BGP routes in some scenarios.
Kindly let us know if the above helps or you need further assistance on this issue.
Sign in to comment
Sign in to answer