Dual ISP Failover with Azure VPN to SAP Cloud

[Kso]

We have two Internet Service Providers (ISPs) with Public IPs, and we've set up two tunnels to connect to SAP Cloud in Azure for failover purposes. However, we've encountered an issue when the primary connection goes down: the secondary tunnel doesn't kick in until NAT is enabled.

We've reached out to SAP support, and they've provided some insight: "Azure does not remove static routes from VPNs if they are down. If you require routing to the same local network on multiple VPNs, you must request dynamic routing with BGP."

Now, we're scratching our heads trying to figure out the best course of action. What changes do we need to make to ensure failover works seamlessly? 

[hbac]

Hi @Kso,

If Azure doesn't change the static route, it won't work. For example, FortiGate forwards traffic to tunnel2 because tunnel1 is down. However, Azure still forward traffic to tunnel1 based on its static route. 

You can configure BGP instead of static routes: https://community.fortinet.com/t5/FortiGate/Technical-Note-Dynamic-routing-BGP-over-IPsec-tunnel/ta-...

Regards,