Connect one Azure Subscription via another
We are having 2 Azure VNETs (192.168.0.0/20 & 10.40.1.0/16 respectively) in 2 different subscriptions (Sub - A & Sub - B) and those are connected via VNET Peerings. VMs resides on both VNETs, can able to ping each other. We do have Cisco AnyConnect VPN for users to connect directly to Sub - A. Now we need some setup so that users can able to reach directly to Sub - B when connected with AnyConnect VPN. We have done following -
- For Sub - A, we have enabled VNET Gateway
- For Sub - B, we have enabled to use VNET Gateway
- Added route on Cisco AnyConnect VPN
Need to understand how we can achieve the setup so that users can able to reach 10.40.1.0/16 network while connected with Cisco AnyConnect VPN. Attaching a sample network diagram for reference.
• Yes, you can configure Cisco Anyconnect VPN to connect to two virtual networks in different subscriptions by configuring two different tunnel groups on the Cisco Anyconnect VPN server. To configure the two tunnel groups wherein the virtual network gateways are to be connected in different subscriptions for two different virtual networks, you will have to define the VPN protocols for connecting to the VPN session wherein the IP address used to connect on the inside of the network after the remote user’s traffic has passed through the ASA firewall server as shown below : -
ip local pool ANYCONNECT_POOL1 10.99.1.1-10.99.1.254 mask 255.255.255.0
ip local pool ANYCONNECT_POOL2 10.99.2.1-10.99.2.254 mask 255.255.255.0
• Once done, then configure the two tunnel groups called ‘ANYCONN_1’ and ‘ANYCONN_2’ as have been assigned to the first pool according to the first tunnel group and the second pool to the second tunnel group.
!
tunnel-group ANYCONN_1 type remote-access
tunnel-group ANYCONN_1 type general-attributes
address-pool ANYCONNECT_POOL1
authentication-server-group MYRADIUS
default-group-policy NOACCESS
tunnel-group ANYCONN_1 webvpn-attributes
group-alias EMPLOYEES enable
!
tunnel-group ANYCONN_2 type remote-access
tunnel-group ANYCONN_2 type general-attributes
address-pool ANYCONNECT_POOL2
authentication-server-group MYRADIUS
default-group-policy NOACCESS
tunnel-group ANYCONN_2 webvpn-attributes
group-alias VENDORS enable
!
• Then, ensure that the group policies are set for employees and other groups of people that are going to connect through the Cisco Anyconnect VPN client post successful authentication and authorization. For that purpose, you will have to create a group policy accordingly for those set of users as below: -
!
group-policy STAFF_VPN_GROUP internal
group-policy STAFF_VPN_GROUP attributes
vpn-tunnel-protocol ssl-client
vpn-filter value STAFF_VPN_ACL
!
group-policy NOACCESS internal
group-policy NOACCESS attributes
vpn-tunnel-protocol ssl-client
vpn-simultaneous-logins 0
!
Then apply the VPN filter, the configuration and authenticate the logic flow as below: -
!
access-list STAFF_VPN_ACL extended permit ip any any
!
webvpn
enable OUTSIDE
anyconnect enable
tunnel-group-list enable
!
vpn-simultaneous-logins 0
access-list extended permit ip any 10.99.99.0 255.255.255.0
VENDOR_VPN_ACL
Thus, in this way, through the functionality use of active phase tunnelling protocol, you can surely create multiple connections from a Cisco Anyconnect VPN server to other virtual networks in other subscriptions.
For more information regarding this, kindly refer to the below links: -