Transit Gateway BGP Over LAN in Azure Workflow

​

Introduction

1. Deploy Aviatrix Multicloud Transit Solution
2. Launch Third-Party Cloud Instances
3. Build BGP over LAN

• Multicloud Transit BGP over LAN in AWS Workflow
• Multicloud Transit BGP over LAN in GCP Workflow

• Multicloud Transit Network Workflow Instructions (AWS/Azure/GCP/OCI)
• Aviatrix Transit Gateway to External Devices
• Transit Network Design Patterns

​

The key ideas for this solution are:

• A BGP session establishes between a third-party cloud instance and Aviatrix Transit Gateway via each LAN interface in different VNets.
• Data plane traffic also runs between a third-party cloud instance and Aviatrix Transit Gateway via each LAN interface without a tunnel protocol such as IPsec and GRE.

​

Prerequisites

• This feature is available for 6.3 and later. Upgrade Aviatrix Controller to at least version 6.3.
• In this example, you are going to deploy the below VNets in Azure:
  • Transit VNets (for example, 10.1.0.0/16 and 10.2.0.0/16) by creating a VNet with the VPC Function Aviatrix FireNet VNet option enabled.
  • Spoke VNets (for example, 192.168.11.0/24 and 192.168.21.0/24) by creating a VNet as per the previous step or manually deploying it in each cloud portal. You can use your existing cloud network.
• Third-party cloud instance supports high throughput.

​

Deploying Aviatrix Multicloud Transit Solution

1. Deploy Aviatrix Multicloud Transit Gateway and HA with High Performance Encryption Mode enabled in Transit VNet.

2. Deploy Spoke Gateway and HA to launch Aviatrix Spoke gateway and enable HA with High Performance Encryption enabled in Spoke VNet.
3. Attach Spoke Gateways to Transit Network.
4. (Optional) You can attach Azure Spoke VNet via native peering if you prefer not to encrypt the traffic between the Transit VNet and the Spoke VNet.

​

Launch Third-Party Cloud Instances

1. Create a third-party cloud instance and put the MGMT interface in the public gateway subnet.
2. Create a new public WAN subnet and a dedicated routing table for the WAN interface if needed.
3. Create a new private LAN subnet and a dedicated routing table for the LAN interface.
4. Make sure the IP forwarding function on third-party cloud instance interfaces is enabled.

​

Building BGP over LAN

​

Creating Azure VNet Peering Between Aviatrix Transit VNet and Third-Party Cloud Instance Transit VNet

1. In CoPilot, navigate to Networking > Connectivity > Native Peering.
2. Click +Native Peering.
3. In the Create Native Peering dialog, select Azure Cloud.
4. Select the VNet where the Aviatrix Transit gateway is located as Peer1.
5. Select the VNet where the third-party cloud instance is located as Peer2.
6. You can also select the route tables for each VNet by sliding Select Route Tables to On.
7. Click Save.

​

Configuring BGP over LAN on Aviatrix Transit Gateway

resource "aviatrix_transit_external_device_conn" "azure_bgp_over_lan" {
  vpc_id            = "transit-vnet:transit-rg:11111111-1111-1111-1111-111111111111"
  connection_name   = "azure-bgp-over-lan-conn"
  gw_name           = "transit-gw-azure-01"
  connection_type   = "bgp"
  tunnel_protocol   = "LAN"
  bgp_local_as_num  = "65001"
  bgp_remote_as_num = "65002"
  remote_lan_ip     = "10.2.4.10"
  remote_vpc_name   = "sdwan-vnet:sdwan-rg:11111111-1111-1111-1111-111111111111"
}

​

(Optional) Downloading the BGP over LAN configuration sample from Aviatrix Controller

1. On the External Connections (S2C) tab, click the vertical ellipsis and then select Download Configuration.
2. In the Download Configuration dialog, select the following:

• Vendor: select the device you are using (any device that is capable of running IPsec and BGP).
• Platform: select the applicable platform for the chosen device.
• Software: automatically selected based on the Vendor/Platform you select.

3. Click Download.

​

Configuring BGP over LAN on Third-Party Cloud Instance

1. Log in to the Azure portal.
2. Create a user-defined routing table with default route (0.0.0.0/0) pointing nexthop to the Aviatrix Primary Transit LAN IP for the subnet where the third-party cloud primary instance LAN interface is located.
3. Create a user-defined routing table with default route (0.0.0.0/0) pointing nexthop to the Aviatrix HA Transit LAN IP for the subnet where third-party cloud HA instance’s LAN interface is located, for HA deployment.
4. (Optional) Open the downloaded BGP over LAN configuration file.
5. Log in to the third-party cloud instance.
6. Program route to send traffic to the Aviatrix Transit LAN IP through the third-party cloud instance LAN interface.
7. Configure the related BGP and LAN information in the third-party cloud instance.
8. Check if the function ‘eBGP multi-hop’ is enabled, if the BGP session is not established.
9. Repeat these steps for HA deployment.

​

Verifying LAN and Transit Status

• LAN status: Navigate to Diagnostics > Cloud Routes > External Connections. The Status and Tunnel Status columns indicate if the tunnel is Up or Down.
• Transit gateway status: Navigate to Diagnostics > Cloud Routes > Gateway Routes. The Gateway Status and Tunnel Status columns indicate if the gateway and tunnel are Up or Down.

​

Verifying BGP Session Status

​

Ready to Go

​

Performance Benchmarks

​

End-to-End traffic via Native Spoke VNet - Aviatrix - Aviatrix - Native Spoke VNet

Multiple flows result by using iperf3 tool with TCP 128 connections