6

I am configuring an Azure VPN with site-to-site connectivity to a large enterprise customer. I have configured the following address space:Address space config

Now the customer has asked "Could you please send us traffic with one ip address, instead of range (192.168.2.0/27)"

I will only have one VM on the VPN so I can pick any IP in the range, but should I pick one from the Subnet-1 range or the Gateway range? What will the customer see our traffic as coming from?

Edit Once I answered my own question I realised how poor the title was so I've edited it.

2 Answers 2

13

The answer is no. Do not use the gateway subnet.

I eventually found exactly what I required on this Microsoft page. Specifically:

And don't deploy VMs or anything else to the gateway subnet.

and

Can I deploy Virtual Machines or role instances to my gateway subnet?

No.

1

By default, VPN gateways are deployed as two instances in an active/standby configuration, even if you only see one VPN gateway resource in Azure. When planned maintenance or unplanned disruption affects the active instance, the standby instance automatically assumes responsibility for connections without any user intervention. Connections are interrupted during this failover, but they're typically restored within a few seconds for planned maintenance and within 90 seconds for unplanned disruptions.

The new guidance is now - Use at least a /27 address mask for the gateway subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.