S2S VPN with Active/Active FW Behind LB

[catg80]

Hey all,

we have 2 active palos in azure that are behind a public load balancer.

have to create a S2S VPN between our tenancy and another orgs tenancy.

has anyone done this before?

not sure how can get this to work as traffic going through the load balancer seems to cause issues as its a long running connection. 

anyone know of any design guides that would discuss scenarios on this?

thanks

[aleksandar.astardzhiev]

Hi @catg80 ,

In my humble opinion what you asking is not possible.

- Azure Load Balancer workin on layer4 and support only TCP and UDP transport protocols

- IPsec site-to-site VPN usually requries ESP transport protocol, which is not supported by Azure LB

- As described in the following link you can use Azure LB for outbound connections, but outbound traffic is not actuall passive through the LB. Traffic is just simply tranlated (NAT) to the public IP assigned to the LB. https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections

I personally don't like running Site-to-Site tunnels on firewall in Azure or AWS.

I would preffer to use the cloud native components and establish the tunnel to Azure VPN gateway and if required use routing tables to forward the traffic from/to the tunnel to PAN FW for inspection.

You metioned "between our tenancy and another orgs tenancy" - does this means you want to exchange traffic between your Azure  enviroment and another Azure environment? If that is correct, I would recommend to use Azure Private Link and Private Endpoints - https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/service/private-link

Yuo could still route such traffic over your firewall for inspection, but instead of adding the complexity of maintaining IPsec tunnel, just use the cloud native components to send it to the other organization.