Will there be asymmetric traffic if two tunnels have the same private address space defined or overlapped ?

$@chin 115

Suppose I already have an S2S tunnel A on the vWAN with a private address space of 192.12.0.0/16, provided by the on-prem team, and a link IP address A. now need to create another S2S tunnel B on the same vWAN hub, with link IP address B. However, the private address space for tunnel B is 192.12.5.0/24, which falls within the address range of tunnel A (192.12.0.0/16).

Will this overlap cause any issues with tunnel communication to the Azure VMs or vice versa ? Is there a risk of asymmetric traffic ? Or can this be configured without any issues, assuming traffic from both on-prem locations can still communicate with Azure resources via the vWAN s2s tunnels ?

if not, how to achieve it instead of changing the private address space ?

Sai Prasanna Sinde 1,265 Reputation points Microsoft Vendor

2024-11-08T08:42:42.5+00:00
Hi @$@chin,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Will this overlap cause any issues with tunnel communication to the Azure VMs or vice-versa? Is there a risk of asymmetric traffic?

As the private address space for Tunnel B (192.12.5.0/24) falls within the address range of Tunnel A (192.12.0.0/16), all traffic will be directed to Tunnel B (192.12.5.0/24). This process occurs because (192.12.5.0/24) is a longer prefix than (192.12.0.0/16).

When outbound traffic is sent from a subnet, Azure selects a route based on the destination IP address, using the longest prefix match algorithm.

Please refer to the below document to understand how Azure selects a route: Reference: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

How to achieve it instead of changing the private address space?

For time-being, we would recommend you configure NAT rules for your Virtual WAN VPN gateway.

A NAT rule provides a mechanism to set up one-to-one translation of IP addresses. NAT can be used to interconnect two IP networks that have incompatible or overlapping IP addresses

Please refer to this document to understand how to configure NAT rules for your Virtual WAN VPN gateway: https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway#rules

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
$@chin 115 Reputation points

2024-11-08T18:14:42.0966667+00:00

Hi @Sai Prasanna Sinde ,

Thank you for the explanation.

For Point1: But we have different link IP addresses on both tunnels.

For Point2: If we use a NAT gateway, will it cause any issues with the existing tunnel connection? If yes, how, and what additional measures need to be taken to ensure that the existing connection remains smooth without any interruptions? Are there any additional configurations required on both Azure and on-premises?
Sai Prasanna Sinde 1,265 Reputation points Microsoft Vendor

2024-11-13T02:27:45.8+00:00

Hi @$@chin,

Sorry for the delay in response.

Adding a NAT Gateway should not interrupt the existing Tunnel Connection.

The NAT will be applied to the new connection only and on the same VPN gateway, you can have some connections with NAT and other connections without NAT working together.

So, no need to edit the existing tunnel connections.

Although we would recommend you perform this task during a maintenance window.

Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/nat-overview#is-nat-applied-to-all-connections-on-a-vpn-gateway

Kindly let us know if the above helps or you need further assistance on this issue.

Regards,

Sai Prasanna.
$@chin 115 Reputation points

2024-11-13T18:34:37.38+00:00

Hi,

Here I have vWAN. Will it be the same for this as well ?
Sai Prasanna Sinde 1,265 Reputation points Microsoft Vendor

2024-11-14T02:27:25.22+00:00
Hi @$@chin,

Greetings!

Yes, it would be same for vWAN as well.

Please refer to this document to understand how to configure NAT rules for your Virtual WAN VPN gateway: https://learn.microsoft.com/en-us/azure/virtual-wan/nat-rules-vpn-gateway#rules

Kindly let us know if you have any other query on this issue.

Regards,

Sai.
Sai Prasanna Sinde 1,265 Reputation points Microsoft Vendor

2024-11-15T01:24:11.16+00:00

Hi @$@chin,

Greetings!

Following up to see if the above provided information was helpful. please let us know if you have any other queries.

We are pleased to assist you.

Thanks,

Sai.
Sai Prasanna Sinde 1,265 Reputation points Microsoft Vendor

2024-11-18T02:03:36.5366667+00:00

Hi @$@chin,

Hope you are having a great day.

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

If you are still facing any further issues, please don't hesitate to reach out to us. We are happy to assist you.

Looking forward to your response and appreciate your time on this.

Regards,

Sai.

Share via

Will there be asymmetric traffic if two tunnels have the same private address space defined or overlapped ?

Your answer