20221129 Azure Route Exchange: 以 Azure VMware Solution 為例

#avs #azure #networking

YouTube: https://www.youtube.com/watch?v=F9voykz0Brs

Transcript

1. Azure Route Exchange
   Phil Huang
   Sr. Cloud Solution Architect
   2022/11/29
   以 Azure VMware Solution 為例
   

   View Slide

2. Challenge
   Azure Networking
   

   View Slide

3. FortiGate 60E
   wan1
   Public IP: x.x.x.x
   internal1
   192.168.100.254/24
   Surface
   192.168.100.6/24
   Azure VMware Solution
   10.7.0.0/22
   D-MSEE
   

   View Slide

4. On-premise Source IP: 192.168.100.6
   vCenter IP of Azure VMware Solution in Canada Central : 10.7.0.2
   

   View Slide

5. Hint
   Azure Networking
   

   View Slide

6. Azure VMware Solution 連線特性
   Already enable VMware NSX-T Edge
   • 一座 Azure VMware Solution 提供 2 種 Peering 方式
   1. Azure ExpressRoute
   2. Azure ExpressRoute Global Reach (對方也須具備 ExpressRoute 才能用)
   • 預設狀況下，AVS BGP Peering 是由 Azure 所自動設定
   • AS Path: 64513 (AVS BGP ASN) -> 65100 -> ... -> 398656 -> 12076 -> Customer Managed ASN
   

   View Slide

7. Azure ExpressRoute 連線特性
   Private Connection to Microsoft Cloud
   Ref: https://learn.microsoft.com/en-us/azure/route-server/expressroute-vpn-support
   • 若已具備 ExpressRoute 且須連到指定 Azure VNet，
   則需在該 Azure VNet 使用 Virtual Network
   Gateway (VNG) 並採用 ExpressRoute Type 接入網
   路
   • 若有需要跟其他線路進行路由，則需要在該 Azure
   VNet 使用 Azure Route Server，並啟用 Branch-to-
   Branch 協助路由宣告 (Route Propagate)
   

   View Slide

8. Virtual Network Gateway 使用特性
   Access to Azure virtual network
   • Virtual Network Gateway 提供 2 種 Gateway Type，可共存
   同一個 Azure VNet
   1. VPN
   2. ExpressRoute
   • 若需與 Azure Route Server 交換路由，則需要滿足下列條件
   

   View Slide

9. 觀察 BGP Peer 及 Learned Routes 狀態
   Virtual Network Gateway
   • 選擇 VPN Gateway > Monitoring
   > BGP Peers
   

   View Slide

10. Azure Route Server 使用特性
    Enables exchange route information with Azure virtual networks
    • 預設狀況下，Azure Route Server 會啟用 BGP，且 ASN 為 65515
    • 無需額外進行 BGP Peer 操作，預設自動跟所在 Azure VNet 之 GatewaySubnet 進行路由交換
    

    View Slide

11. Route Exchange with Static
    Route between ExpressRoute
    and S2S VPN
    Case 1
    Common Use Case!!!
    

    View Slide

12. Ref:
    FortiGate 60E
    wan1
    Public IP: x.x.x.x
    internal1
    192.168.100.254/24
    Surface
    192.168.100.6/24
    • No BGP
    • Static Route Only
    Azure VMware Solution
    10.7.0.0/22
    D-MSEE
    ExpressRoute
    vnet-hub
    10.10.0.0/24
    ExpressRoute
    Gateway
    GatewaySubnet
    10.10.0.0/27
    AzureRouteSubnet
    10.10.0.32/27
    ars-hub
    ASN: 65515
    private-ip: 10.10.0.37
    private-ip: 10.10.0.36
    S2S VPN
    Gateway
    pip-vpn-1
    pip-vpn-2
    pip-er
    pip-ars
    private-ip-1: 10.10.0.14
    private-ip-2: 10.10.0.15
    ASN: 65515
    Solution
    - Create VNet
    - Create ExpressRoute Gateway (Basic SKU)
    - Create VPN Gateway
    - Active-Active Mode
    - Enable BGP
    - ASN: 65515
    - Create Azure Route Server
    - Enable branch-to-branch
    

    View Slide

13. Ref:
    FortiGate 60E
    wan1
    Public IP: x.x.x.x
    internal1
    192.168.100.254/24
    Surface
    192.168.100.6/24
    • No BGP
    • Static Route Only vWAN
    10.10.0.0/24
    ExpressRoute
    Gateway
    GatewaySubnet
    10.10.0.0/27
    AzureRouteSubnet
    10.10.0.32/27
    ars-hub
    ASN: 65515
    private-ip: 10.10.0.37
    private-ip: 10.10.0.36
    S2S VPN
    Gateway
    pip-vpn-1
    pip-vpn-2
    pip-er
    pip-ars
    private-ip-1: 10.10.0.14
    private-ip-2: 10.10.0.15
    ASN: 65515
    Azure VMware Solution
    10.7.0.0/22
    D-MSEE
    ExpressRoute
    Solution
    - Create vWAN
    - Create vHub
    

    View Slide

14. Case 1
    Azure VMware Solution
    NSX-T T0 BGP ASN: 64513
    10.7.0.0/22
    

    View Slide

15. Route Exchange with eBGP
    between ExpressRoute and
    S2S VPN
    Case 2
    

    View Slide

16. Ref:
    FortiGate 60E
    ASN: 65533
    wan1
    Public IP: x.x.x.x
    internal1
    192.168.100.254/24
    Surface
    192.168.100.6/24
    • BGP ASN: 65533
    Azure VMware Solution
    10.7.0.0/22
    D-MSEE
    ExpressRoute
    vnet-hub
    10.10.0.0/24
    ExpressRoute
    Gateway
    GatewaySubnet
    10.10.0.0/27
    AzureRouteSubnet
    10.10.0.32/27
    ars-hub
    ASN: 65515
    private-ip: 10.10.0.37
    private-ip: 10.10.0.36
    S2S VPN
    Gateway
    pip-vpn-1
    pip-vpn-2
    pip-er
    pip-ars
    private-ip-1: 10.10.0.14
    private-ip-2: 10.10.0.15
    ASN: 65515
    Solution
    - Create VNet
    - Create ExpressRoute Gateway (Basic SKU)
    - Create VPN Gateway
    - Active-Active Mode
    - Enable BGP
    - ASN: 65515
    - Create Azure Route Server
    - Enable branch-to-branch
    

    View Slide

17. Case 2: Route Traffic
    Azure VMware Solution
    NSX-T T0 BGP ASN: 64513
    10.7.0.0/22
    ASN: 65533
    

    View Slide

18. Route Exchange with multi
    eBGP between ExpressRoute
    and S2S VPN
    Case 3
    

    View Slide

19. Ref:
    FortiGate 60E
    ASN: 65533
    wan1
    Public IP: x.x.x.x
    internal1
    192.168.100.254/24
    Surface
    192.168.100.6/24
    Azure VMware Solution
    10.7.0.0/22
    D-MSEE
    ExpressRoute
    vnet-hub
    10.10.0.0/24
    ExpressRoute
    Gateway
    GatewaySubnet
    10.10.0.0/27
    AzureRouteSubnet
    10.10.0.32/27
    ars-hub
    ASN: 65515
    private-ip: 10.10.0.37
    private-ip: 10.10.0.36
    S2S VPN
    Gateway
    pip-vpn-1
    pip-vpn-2
    pip-er
    pip-ars
    private-ip-1: 10.10.0.14
    private-ip-2: 10.10.0.15
    ASN: 300
    Solution
    - Create VNet
    - Create ExpressRoute Gateway (Basic SKU)
    - Create VPN Gateway
    - Active-Active Mode
    - Enable BGP
    - ASN: 300
    - Create Azure Route Server
    - Enable branch-to-branch
    

    View Slide

20. Case 3: Route Traffic
    ASN: 300
    Azure VMware Solution
    NSX-T T0 BGP ASN: 64513
    10.7.0.0/22
    

    View Slide

21. Conclusion
    Azure Networking
    • 若於地端並無配置 BGP 設計，僅具有 Static Route / Policy Route，則可以透過 Case 1 方式將路由接入
    至 Azure
    • 若地端有 BGP 設定，則可透過 Case 2 與 Azure Private ASN 65515 進行路由交換
    • 若有特殊架構規劃需求，則可透過 Case 3 或額外建立 NVA (如 FRRouting on Azure VM / 3rd party SD-
    WAN / vRouter 等) 實踐
    

    View Slide

22. Invent with purpose.
    

    View Slide