Search code examples
azureazure-virtual-machineazure-vpn

Multi site hybrid VPN solution - is it possible?

Here is a scenario I considering to support:

  1. Multiple organizations, each one has its own local network (I can't change their addresses, need to deal with what they have)

  2. I want to have single Azure VM, which will run "agent". This "agent" need to be able to connect on demand to any of customer's machines as administrator, and perform various operations (such as creating users). Also it must be able to reach organization's AD

  3. All organizations need to be connected to the same Azure VM (to the same "agent")

  4. Organizations should be isolated one from other (e.g. no connections between local networks)

    Does such scenario supported by Azure?

Solution

  • According to your scenario, you could create Multi Site-to-Site VPN. You create more than one VPN connection from your virtual network gateway, typically connecting to multiple on-premises sites. When working with multiple connections, you must use a RouteBased VPN type (known as a dynamic gateway when working with classic VNets). Because each virtual network can only have one VPN gateway, all connections through the gateway share the available bandwidth. This is often called a "multi-site" connection.

    enter image description here

    More information about how to configure multi site-to-site VPN please refer to this link.

    However, there are a few points that need to be explained.

    Multiple organizations, each one has its own local network (I can't change their addresses, need to deal with what they have)

    None of the address ranges overlap for any of the VNets that this VNet is connecting to. If the IP address ranges overlap, it is not possible do it.More information please refer to this FAQ.

    All organizations need to be connected to the same Azure VM (to the same "agent")

    You could create a VM in the Vnet and you could access to all your organizations, you don't need a "agent".

    Organizations should be isolated one from other (e.g. no connections between local networks)

    Azure supports this, when you build VPN connections, organizations is isolated one from other by default.