BGP and Vnet Peering

Hello Handian,

Welcome to Q&A, I uderstand that you can't reach vNet2 from on-premises without BGP enabled, but when BGP is enabled, vNet2 becomes unreachable?

When BGP is disabled, your VPN Gateway likely uses static routing to reach vNet1 and vNet2. In this case, the static routes enable communication between your on-premises network and both VNets, even if the peered VNets (vNet1 and vNet2) don't propagate routes dynamically. Static routes don't rely on BGP advertisements for connectivity.

However, when BGP is enabled, the VPN Gateway switches to dynamic routing. It advertises only the routes to directly connected networks (like vNet1) to your on-premises network. Routes to peered VNets (like vNet2) are not automatically propagated through the VPN Gateway, which causes vNet2 to become unreachable from on-premises.

I do think you can fix the issue if you include vNet2's routes in the BGP advertisements to your on-premises network:

• Enable "Allow Gateway Transit" in vNet2's peering configuration.
• Enable "Use Remote Gateways" in vNet1's peering configuration.
• Confirm that your on-premises BGP router is correctly handling and adding the routes for vNet2.

Let me know your findings.

References:

• https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit
• https://learn.microsoft.com/en-us/answers/questions/802735/azure-vnet-peering-and-use-remote-gateways

If the information helped address your question, please Accept the answer.

Luis

Hi @Handian Sudianto

Adding to Luis Arias,

• Go to the VNet Peering configuration for VNet1 > VNet2. Ensure "Allow gateway transit" is checked and go to the VNet Peering configuration for VNet2 > VNet1. Ensure "Use remote gateways" is checked. Please re-verify them, sometimes updates can reset settings.
• Go to you Virtual Network Gateway, under monitoring, select BGP Peers and verify that the BGP peering session with your on-premises router is Connected. If not, troubleshoot the BGP configuration.
• On the same BGP Peers page in the Azure portal, select your on-premises peer and click on get advertised routes and check if the address prefixes for VNet2 are listed. If they are missing, Azure is not advertising them via BGP. 
• Log in to your on-premises BGP router and use the appropriate command for your vendor to see the routes being learned from the Azure VPN Gateway's BGP peer IP and confirm if the VNet2 address prefix is present in this list. If it's missing, but was present in the advertised routes in Azure, then there might be an issue with the BGP session itself.

Kindly let us know if the above helps or you need further assistance on this issue.