sjackson0109
commented
1 year ago OK, so I can build the VNG now... without BGP APIPA addressing..
virtual_network_gateways = {
uks_hub_test = {
name = "ukw-hub-test"
resource_group_key = "hub"
type = "Vpn"
sku = "VpnGw2AZ"
generation = "Generation2"
vpn_type = "RouteBased"
active_active = true
private_ip_address_enabled = false #tried false and true here, no difference.
ip_configuration = {
# NOTE: number of public IPs depends:
# No matter what SKU you have, you NEED 1x PIP address
# Is it an Active/Active appliance? Yes: 1x additional PIP required for the second unit
# Is this an SSLVPN Endpoint? Yes: 1x additional PIP required (ha)
ipconfig1 = {
ipconfig_name = "ukw-hub-vng2-pip-primary-config"
public_ip_address_key = "ukw_hub_vng2_pip_primary"
vnet_key = "ukw_hub"
private_ip_address_allocation = "Dynamic"
}
ipconfig2 = {
ipconfig_name = "ukw-hub-vng2-pip-secondary-config"
public_ip_address_key = "ukw_hub_vng2_pip_secondary"
vnet_key = "ukw_hub"
private_ip_address_allocation = "Dynamic"
}
}
## P2P VPN CONFIG
enable_bgp = true
bgp_settings = {
config = {
asn = 65099
peer_weight = 100
## Virtual-Tunnel-Interfaces (VTIs)
# peering_addresses = {
# vti_primary = {
# ip_configuration_name = "ukw-hub-vng-vti-primary"
# apipa_addresses = ["169.254.21.1"]
# }
# vti_secondary = {
# ip_configuration_name = "ukw-hub-vng-vti-secondary"
# apipa_addresses = ["169.254.22.1"]
# }
# }
}
}
}
}But when I un-comment by peering_addresses map, it fails to build with another error:
│ Error: Creating/Updating Virtual Network Gateway: (Name "vgw-ukw-hub-test" / Resource Group "HUB"):
│ network.VirtualNetworkGatewaysClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error:
│ Code="BgpPeeringAddressesCountNotCorrect" Message="The BgpPeeringAddresses count is incorrect for gateway
│ /subscriptions/REDACTED/resourceGroups/HUB/providers/Microsoft.Network/virtualNetworkGateways/vgw-ukw-hub-test.
│ It should be 1 for ActivePassive and 2 for ActiveActive gateway." Details=[]
Objective
Migrate my customers LZ configuration from IaC to CaC, using the terraform, with the aztfmod module.
Background
The entire enterprise scale "wheel" has been built. Vnet peering is rejected when advertising 'gateway' across to the peer (guess MS's API checks for the presence of a VNG appliance). So I need to include the VNG appliance, including all it's desired configuration.
Issue
Using the VNG appliance, with the AZ SKU (2x public vpn endpoints), I cannot get the
bgp_settingsblock to work.This link provides an example to follow; but even that code is incorrect. Specifically
peering_addresses block is not found.Doing my own reading
I have read the code block that actually creates the azurerm_virtual_network_gateway resource, looking at the
bgp_settingsblock between lines 137-151 of this file. Note the presence ofpeering_addresses, notpeering address, confirming the example is definitely invalid!Products:
Terraform Configuration Files
Expected Behaviour
Expect a VNG appliance to build with BGP configuation applied.
Actual Behaviour
No BGP configuration was saved, as there needs to be a minimum of one peering_address for the configuration to save.