Connect ExpressRoute gateway with circuits from diverse peering locations for resilience
Impact:HighCategory:High Availability
APRL GUID:d37db635-157f-584d-9bce-4f6fc8c65ce5
Description:
To increase reliability, it's advised that each ExpressRoute gateway connects to at least two circuits, with each circuit originating from a different peering location than the other, ensuring diverse connectivity paths for enhanced resilience.
Click the Azure Resource Graph tab to view the query
//AzureResourceGraphQuery//ProvidesalistofExpressRouteGatewaysthatarenotconnectedtotwoormoreExpressRouteCircuits.Baremetalcircuitsareexcludedfromconsideration//Thisqueryassumesthattherunningentityhasvisibiltytothegateway,connection,andcircuitscopes.//Startwithafulllistofgateways(resources|wheretype=="microsoft.network/virtualnetworkgateways"|whereproperties.gatewayType=="ExpressRoute"|extendexrGatewayId=tolower(tostring(id))|joinkind=inner(resources|wheretype=="microsoft.network/virtualnetworkgateways"|whereproperties.gatewayType=="ExpressRoute"|extendexrGatewayId=tolower(tostring(id))|joinkind=leftouter(//connectionsjoinedwithcircuitpeerinforesources|wheretype=="microsoft.network/connections"|extendconnectionType=properties.connectionType|extendexrGatewayId=tolower(tostring(properties.virtualNetworkGateway1.id))|extendpeerId=tolower(tostring(properties.peer.id))|extendconnectionId=tolower(tostring(id))|whereconnectionType=="ExpressRoute"|joinkind=leftouter(resources|wheretype=="microsoft.network/expressroutecircuits"//shouldthisbelocationinsteadofpeeringLocation|extendcircuitId=tolower(tostring(id))|extendpeeringLocation=tostring(properties.serviceProviderProperties.peeringLocation)|extendpeerId=tolower(id))onpeerId)onexrGatewayId//removebaremetalservicesconnections/circuits|wherenot(isnotnull(connectionId)andisnull(sku1))//groupbygatewayID's and peering locations
| summarize by exrGatewayId, peeringLocation
//summarize to connections with fewer than two unique connections
| summarize connCount = count() by exrGatewayId
| where connCount < 2) on exrGatewayId
| project recommendationId = "d37db635-157f-584d-9bce-4f6fc8c65ce5", name, id, tags, param1 = "twoOrMoreCircuitsConnectedFromDifferentPeeringLocations: false")
| union
(
resources
| where type == "microsoft.network/virtualnetworkgateways"
| where properties.gatewayType == "ExpressRoute"
| extend exrGatewayId = tolower(tostring(id))
| join kind=leftouter(
//connections joined with circuit peer info
resources
| where type == "microsoft.network/connections"
| extend connectionType = properties.connectionType
| extend exrGatewayId = tolower(tostring(properties.virtualNetworkGateway1.id))
| extend peerId = tolower(tostring(properties.peer.id))
| extend connectionId = tolower(tostring(id))
| where connectionType == "ExpressRoute") on exrGatewayId
| where isnull(connectionType)
| project recommendationId = "d37db635-157f-584d-9bce-4f6fc8c65ce5", name, id, tags, param1 = "twoOrMoreCircuitsConnectedFromDifferentPeeringLocations: false", param2 = "noConnectionsOnGateway: true"
)
Use Zone-redundant ExpressRoute gateway SKUs
Impact:HighCategory:High Availability
APRL GUID:bbe668b7-eb5c-c746-8b82-70afdedf0cae
Description:
Azure ExpressRoute gateway offers variable SLAs based on deployment in single or multiple availability zones. To deploy virtual network gateways across zones automatically, use zone-redundant gateways for accessing critical, scalable services with increased resilience.
Configure an Azure Resource lock for ExpressRoute gateway to prevent accidental deletion
Impact:MediumCategory:High Availability
APRL GUID:c0f23a92-d322-4d4d-97e9-a238b5e3bbb8
Description:
Configuring an Azure Resource lock for ExpressRoute gateway prevents accidental deletion by enabling administrators to lock an Azure subscription, resource group, or resource, thereby protecting them from unintended user deletions and modifications, with the lock overriding all user permissions.
Click the Azure Resource Graph tab to view the query
//under-development
Avoid using ExpressRoute circuits for VNet to VNet communication
Impact:MediumCategory:High Availability
APRL GUID:194c14ac-0d7a-5a48-ae32-75fa450ee564
Description:
While multiple VNets can connect via the same ExpressRoute gateway, Microsoft recommends using alternatives like VNet peering, Azure Firewall, NVA, Azure Route Server, site-to-site VPN, virtual WAN, or SD-WAN for VNet-to-VNet communication to optimize network performance and management.
ExpressRoute gateways are updated for improved functionality, reliability, performance, and security. Customer-controlled maintenance configuration and scheduling minimize update impact and align with your maintenance windows.
Azure VPN gateway offers variable SLAs based on deployment in one or two availability zones. Deploying zone-redundant virtual network gateways across availability zones ensures zone-resiliency, improving access to mission-critical, scalable services on Azure.
The active-active mode is available for all SKUs except Basic, allowing for two Gateway IP configurations and two public IP addresses, enhancing redundancy and traffic handling.
Deploy active-active VPN concentrators on your premises for maximum resiliency with VPN gateways
Impact:HighCategory:Disaster Recovery
APRL GUID:af11fc4c-c06c-4f4c-b98d-6eee6d5c4c70
Description:
Deploying active-active VPN concentrators and Azure VPN Gateways maximizes resilience and availability using a fully-meshed topology with four IPSec tunnels.
Click the Azure Resource Graph tab to view the query
//under-development
Monitor VPN gateway connections and health
Impact:HighCategory:Monitoring and Alerting
APRL GUID:9eab120e-f6d3-ee49-ba0d-766562ce7df1
Description:
Set up monitoring and alerts for Virtual Network Gateway health to utilize a variety of metrics for ensuring operational efficiency and prompt response to any disruptions.
Click the Azure Resource Graph tab to view the query
//under-development
Enable VPN gateway service health
Impact:HighCategory:Monitoring and Alerting
APRL GUID:9186dae0-7ddc-8f4b-bea5-55538cea4893
Description:
VPN gateway leverages service health to inform users about both planned and unplanned maintenance, ensuring they are notified about modifications to their VPN connectivity.
Click the Azure Resource Graph tab to view the query
//under-development
Deploy zone-redundant VPN gateways with zone-redundant Public IP(s)
Impact:HighCategory:High Availability
APRL GUID:4bae5a28-5cf4-40d9-bcf1-623d28f6d917
Description:
For zone-redundant VPN gateways, always use zone-redundant Standard SKU public IPs to avoid deploying all instances in one zone. This ensures the gateway's reliability, applying to both active-passive (single IP) and active-active (dual IP) setups.