# Creating a Single Gateway, Multi-Region, VPN Architecture in Microsoft Azure

https://jaredrhodes.com/blog/creating-a-single-gateway-multi-region-vpn-architecture-in-microsoft-azure/

The goal of this post is to showcase how to create a gateway for a multi-region VPN architecture in Microsoft Azure. We can start from a very basic use case, three regions:

- One containing the VPN gateway all clients will connect through
- Two other regions containing resources connected to the vNet gateway

> This post was originally published in April 2019 and walks through the Azure portal as it looked then. The portal has changed since, and VPN gateways now support more SKUs and static public IP allocation than described below. Treat the step-by-step screens as a historical reference and check Microsoft's VPN Gateway documentation for the current flow.

There are two terms that will be used throughout this post:

- *Hub* - this refers to the central VPN Gateway that all other VPN Gateways will connect to.
- *Spoke* - this refers to an individual VPN Gateway that connects to the *Hub*

## Planning

Since there will be a vNet for each region, with each spoke's gateway tunneling back to the hub, address spacing should be taken into consideration before creating each Virtual Network in a region. From previous experience, it was considered best practice to:

Address - {shared}.{region\_specific}.{subnet}.{instance}

For example, the address 10.1.2.3 would break down as shared octet 10, region 1, subnet 2, and instance 3.

- Shared - A common root address was picked for the first octet. This is the best place to avoid conflicts with networks outside of Azure that will connect to the *Hub*.
- Region Specific - Each region would get its own address for the second octet
- Subnet - Each subnet in the region would get an address for the third octet
- Instance - Finally each assigned IP address would fill the fourth octet

This does not account for third party integration and Site-to-Site integrations. Those require future planning.

## Create the vNets

Once the planning phase is complete we will create three Virtual Networks in three separate regions. Which Virtual Network is the *Hub* and which is the *Spokes* does not matter yet. The regions are connected later through VNet-to-VNet connections between the gateways, so all inter-region traffic transits the VPN tunnels rather than VNet peering.

1. Sign in to the [Azure portal](http://portal.azure.com/) and select **Create a resource**. The **New** page opens.
2. In the **Search the marketplace** field, enter *virtual network* and select **Virtual network** from the returned list. The **Virtual network** page opens. ![Locate Virtual Network resource page](https://docs.microsoft.com/en-us/azure/includes/media/vpn-gateway-basic-vnet-rm-portal-include/newvnetportal700.png "Locate virtual network resource page")
3. From the **Select a deployment model** list near the bottom of the page, select **Resource Manager**, and then select **Create**. The **Create virtual network** page opens. ![Create virtual network page](https://docs.microsoft.com/en-us/azure/includes/media/vpn-gateway-basic-vnet-rm-portal-include/vnet.png "Create virtual network page"){: loading="lazy" }
4. On the **Create virtual network** page, configure the VNet settings. When you fill in the fields, the red exclamation mark becomes a green check mark when the characters you enter in the field are validated. Some values are autofilled, which you can replace with your own values:
    - **Name**: Enter the name for your virtual network.
    - **Address space**: Enter the address space. If you have multiple address spaces to add, enter your first address space here. You can add additional address spaces later, after you create the VNet.
    - **Subscription**: Verify that the subscription listed is the correct one. You can change subscriptions by using the drop-down.
    - **Resource group**: Select an existing resource group, or create a new one by entering a name for your new resource group. If you're creating a new group, name the resource group according to your planned configuration values. For more information about resource groups, see [Azure Resource Manager overview](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-overview#resource-groups).
    - **Location**: Select the location for your VNet. The location determines where the resources that you deploy to this VNet will live.
    - **Subnet**: Add the subnet **Name** and subnet **Address range**. You can add additional subnets later, after you create the VNet.
5. Select **Create**.

Before creating a virtual network gateway for your virtual network, you first need to create the gateway subnet. The gateway subnet contains the IP addresses that are used by the virtual network gateway. If possible, it's best to create a gateway subnet by using a CIDR block of /28 or /27 to provide enough IP addresses to accommodate future additional configuration requirements.

1. In the [Azure portal](http://portal.azure.com/), select the Resource Manager virtual network for which you want to create a virtual network gateway.
2. In the **Settings** section of your virtual network page, select **Subnets** to expand the **Subnets** page.
3. On the **Subnets** page, select **Gateway subnet** to open the **Add subnet** page. ![Add the gateway subnet](https://docs.microsoft.com/en-us/azure/includes/media/vpn-gateway-add-gwsubnet-rm-portal-include/addgwsub.png "Add the gateway subnet"){: loading="lazy" }
4. The **Name** for your subnet is automatically autofilled with the value *GatewaySubnet*. This value is required for Azure to recognize the subnet as the gateway subnet. Adjust the autofilled **Address range** values to match your configuration requirements, then select **OK** to create the subnet. ![Adding the subnet](https://docs.microsoft.com/en-us/azure/includes/media/vpn-gateway-add-gwsubnet-rm-portal-include/addsubnetgw.png "Adding the subnet"){: loading="lazy" }

## Create Virtual Network Gateways

Once the Virtual Networks are created, we will create a Virtual Network Gateway for each of the Virtual Networks. Which Virtual Network Gateway is the *Hub* and which is the *Spokes* does not matter yet.

1. Sign in to the Azure portal and select **Create a resource**. The **New** page opens.
2. In the **Search the marketplace field**, enter *virtual network gateway*, and select **Virtual network gateway** from the search list.
3. On the **Virtual network gateway** page, select **Create** to open the **Create virtual network gateway** page. ![Create virtual network gateway page fields](https://docs.microsoft.com/en-us/azure/includes/media/vpn-gateway-add-gw-rm-portal-include/gw.png "Create virtual network gateway page fields"){: loading="lazy" }
4. On the **Create virtual network gateway** page, fill in the values for your virtual network gateway:
    - **Name**: Enter a name for the gateway object you're creating. This name is different than the gateway subnet name.
    - **Gateway type**: Select **VPN** for VPN gateways.
    - **VPN type**: Select the VPN type that is specified for your configuration. Most configurations require a **Route-based** VPN type.
    - **SKU**: Select the gateway SKU from the dropdown. The SKUs listed in the dropdown depend on the VPN type you select. For more information about gateway SKUs, see [Gateway SKUs](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsku). Only select **Enable active-active mode** if you're creating an active-active gateway configuration. Otherwise, leave this setting unselected.
    - **Location**: You may need to scroll to see **Location**. Set **Location** to the location where your virtual network is located. For example, **West US**. If you don't set the location to the region where your virtual network is located, it won't appear in the drop-down list when you select a virtual network.
    - **Virtual network**: Choose the virtual network to which you want to add this gateway. Select **Virtual network** to open the **Choose virtual network** page and select the VNet. If you don't see your VNet, make sure the **Location** field is set to the region in which your virtual network is located.
    - **Gateway subnet address range**: You'll only see this setting if you didn't previously create a gateway subnet for your virtual network. If you previously created a valid gateway subnet, this setting won't appear.
    - **Public IP address**: This setting specifies the public IP address object that's associated with the VPN gateway. At the time this was written, the public IP address was dynamically assigned to this object when the VPN gateway was created. Current VPN gateways support static allocation on newer gateway SKUs, and that is the standard practice now. Whether dynamic or static, allocation doesn't mean that the IP address changes after it has been assigned to your VPN gateway. The only time the public IP address changes is when the gateway is deleted and re-created. It doesn't change across resizing, resetting, or other internal maintenance/upgrades of your VPN gateway.
        - Leave **Create new** selected.
        - In the text box, enter a name for your public IP address.
    - **Configure BGP ASN**: Leave this setting unselected, unless your configuration specifically requires it. If you do require this setting, the default ASN is *65515*, which you can change.
5. Verify the settings and select **Create** to begin creating the VPN gateway. The settings are validated and you'll see the **Deploying Virtual network gateway** tile on the dashboard. Creating a gateway can take up to 45 minutes. You may need to refresh your portal page to see the completed status.
6. After you create the gateway, verify the IP address that's been assigned to it by viewing the virtual network in the portal. The gateway appears as a connected device. You can select the connected device (your virtual network gateway) to view more information.

## Connecting the Gateways

With the Virtual Network Gateways created, it is time to connect the gateways. Starting with the *Hub*, connect the *Hub* to a *Spoke*. Then, connect that *Spoke* back to the *Hub*. Do this for each *Spoke* that is going to connect to the *Hub*.

1. In the Azure portal, select **All resources**, enter *virtual network gateway* in the search box, and then navigate to the virtual network gateway for your VNet. For example, **TestVNet1GW**. Select it to open the **Virtual network gateway** page. ![Connections page](https://docs.microsoft.com/en-us/azure/vpn-gateway/media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/1to4connect2.png "Connections page"){: loading="lazy" }
2. Under **Settings**, select **Connections**, and then select **Add** to open the **Add connection** page. ![Add connection](https://docs.microsoft.com/en-us/azure/vpn-gateway/media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/add.png "Add a connection"){: loading="lazy" }
3. On the **Add connection** page, fill in the values for your connection:
    - **Name**: Enter a name for your connection. For example, *TestVNet1toTestVNet4*.
    - **Connection type**: Select **VNet-to-VNet** from the drop-down.
    - **First virtual network gateway**: This field value is automatically filled in because you're creating this connection from the specified virtual network gateway.
    - **Second virtual network gateway**: This field is the virtual network gateway of the VNet that you want to create a connection to. Select **Choose another virtual network gateway** to open the **Choose virtual network gateway** page.
        - View the virtual network gateways that are listed on this page. Notice that only virtual network gateways that are in your subscription are listed. If you want to connect to a virtual network gateway that isn't in your subscription, use the [PowerShell](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vnet-vnet-rm-ps).
        - Select the virtual network gateway to which you want to connect.
        - **Shared key (PSK)**: In this field, enter a shared key for your connection. You can generate or create this key yourself. In a site-to-site connection, the key you use is the same for your on-premises device and your virtual network gateway connection. The concept is similar here, except that rather than connecting to a VPN device, you're connecting to another virtual network gateway.
4. Select **OK** to save your changes.

## Verify your connections

Locate the virtual network gateway in the Azure portal. On the **Virtual network gateway** page, select **Connections** to view the **Connections** page for the virtual network gateway. After the connection is established, you'll see the **Status** values change to **Succeeded** and **Connected**. Select a connection to open the **Essentials** page and view more information.

![Succeeded](https://docs.microsoft.com/en-us/azure/vpn-gateway/media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/connected.png "Succeeded"){: loading="lazy" }

After verifying the connection was successful, the connection can be tested with a Point-to-Site connection or a Site-to-Site connection.