Share via

cannot establish BGP peer between Vitrual WAN hub and VPN site

Yuanhui Zhang 20 Reputation points
2025-08-22T22:55:56.3233333+00:00

The site-to-site VPN connection between the Virtual WAN hub and on-prem site is up, but the BGP peering is failed. The captured packets on the on-prem router showed the BGP handshake packets are going out, but couldn't see the incoming packets captured at the Azure VPN gateway. Not sure anything needs to be adjusted.

Azure Virtual WAN
Azure Virtual WAN
An Azure virtual networking service that provides optimized and automated branch-to-branch connectivity.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michele Ariis 6,260 Reputation points MVP
    2025-08-23T06:45:34.68+00:00

    Hi, BGP in vWAN must run inside the IPsec tunnel on APIPA IP /30 (169.254.x.x), not to the public IP. Quick checks: 1) Get the two Azure BGP peers and ASN 65515 from the vWAN; on the router set your APIPA IP BGP Link to the same /30 (e.g. Azure 169.254.21.1 ↔ your 169.254.21.2/30) and ASN different from 65515. 2) Configure two neighbors (one per gateway instance) with remote-as 65515, VTI/tunnel source, single-hop eBGP, no NAT; allow TCP/179 in the policies inside the tunnel. 3) Avoid UDRs/routes that send APIPA or Azure peers out of the tunnel. 4) Verification: Show bgp summary (Established), IPsec counters for 179 increasing, vWAN BGP status/learned routes OK. Typical errors: peering to public IP, ASN equal to 65515, only one neighbor configured, ACL blocking 179.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.