# Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration

> Reconcile tunnel identifiers before accepting a multicloud VPN setup.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:55+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Reconcile tunnel identifiers before accepting a multicloud VPN setup.

## Potentially affected

Use this review for the tutorial's BGP-enabled Azure/AWS VPN pattern. Identify each tunnel's outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.

## DSE recommendation

DSE recommends a tunnel matrix before configuring the connections.

## Article

## Source facts

Microsoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp).

## Applicability

Use this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.

## DSE recommendation

DSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.

## Verification

Inspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.

## Official references

[Microsoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp).

## Primary reference

- Name: Tutorial - Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal - Azure VPN Gateway | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-aws-bgp
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-125-match-each-azure-to-aws-vpn-tunnel-with-its-own-bgp-apipa-configuration/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.