Match each Azure-to-AWS VPN tunnel with its own BGP APIPA configuration

Source facts

Microsoft’s Azure-to-AWS VPN tutorial requires each connection object to specify its corresponding custom APIPA BGP address when multiple addresses are configured. Otherwise, the connections use the first address in the list. The tutorial also requires the outside address and BGP peer address of each local network gateway to match the intended AWS tunnel. Microsoft Learn.

Applicability

Use this review for the tutorial’s BGP-enabled Azure/AWS VPN pattern. Identify each tunnel’s outside address, inside address range, Azure gateway instance and connection object. Confirm current address-range and active-active requirements from the complete source.

DSE recommendation

DSE recommends a tunnel matrix before configuring the connections. Assign one row per tunnel and have both cloud owners verify the intended address correspondence. Avoid copying one working connection’s BGP value into the remaining rows without checking their identities. Preserve the approved matrix and previous settings with the change record.

Verification

Inspect each deployed connection and local network gateway against its row. Verify tunnel and BGP status in both clouds, then inspect learned routes and a permitted application transaction. Record evidence per tunnel rather than accepting one healthy connection as proof that all redundant paths are configured correctly.

Official references

Microsoft Learn: Tutorial – Configure a BGP-enabled connection between Azure and Amazon Web Services (AWS) using the portal.