{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "slug": "dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration", "url": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/" }, "title": "Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration", "summary": "Reconcile tunnel identifiers before accepting a multicloud VPN setup.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:55+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Use this review for the tutorial's BGP-enabled Azure/AWS VPN pattern. Identify each tunnel's outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.", "dse_recommendation": "DSE recommends a tunnel matrix before configuring the connections.", "primary_source": { "name": "Tutorial - Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. Microsoft Learn.

\n

Applicability

\n

Use this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.

\n

DSE recommendation

\n

DSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.

\n

Verification

\n

Inspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.

\n

Official references

\n

Microsoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal.

", "content_text": "Source facts\nMicrosoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. Microsoft Learn.\nApplicability\nUse this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.\nDSE recommendation\nDSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.\nVerification\nInspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.\nOfficial references\nMicrosoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal.", "content_markdown": "## Source facts\n\nMicrosoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp).\n\n## Applicability\n\nUse this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.\n\n## DSE recommendation\n\nDSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.\n\n## Verification\n\nInspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.\n\n## Official references\n\n[Microsoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration", "item": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/", "headline": "Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration", "description": "Reconcile tunnel identifiers before accepting a multicloud VPN setup.", "abstract": "Reconcile tunnel identifiers before accepting a multicloud VPN setup.", "articleBody": "Source facts\nMicrosoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. Microsoft Learn.\nApplicability\nUse this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.\nDSE recommendation\nDSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.\nVerification\nInspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.\nOfficial references\nMicrosoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal.", "datePublished": "2026-09-17T16:32:55+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tutorial - Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal - Azure VPN Gateway | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp" } } ] } }