Mastering BGP between Juniper vSRX3 and Azure
Establishing seamless hybrid connectivity between on-premises networks and the cloud is a cornerstone of modern IT infrastructure.
While IPsec tunnels can provide the transport layer, dynamic routing with BGP (Border Gateway Protocol) ensures scalable and resilient route management, especially in environments where subnets change or grow over time.
This post shows step by step setting up BGP on the Juniper vSRX3 and Azure, finally we will also see how to verify BGP is working and some troubleshooting.
About how to setup the tunnel step by step, you will see in my following post.
Or about how to set up the Juniper vSRX3 appliance in vSphere.
Enable BGP in Azure
Below we will see the steps to enable BGP on the already created and working tunnel in Azure.
Finally we need to enable BGP in Azure for the VPN gateway, the local network gateway object and the connection object.
Enable BGP on the Virtual Network Gateway
To enable it on the virtual network gateway, go to Settings -> Configuration and check Configure BGP.
Azure by default will use here the ASN 65515 which is a reserved private ASN (Autonomous System Number) used by Microsoft Azure.
A BGP-enabled connection between two network gateways requires that their ASNs be different. Additionally, the following ASNs are reserved by Azure: 8075, 8076, 12076 (public), 65515, 65517, 65518, 65519, 65520 (private). You cannot specify these ASNs for your on-premises VPN devices when connecting to Azure VPN gateways. While setting up IPsec connectivity from virtual network gateways to Azure virtual WAN VPN, the ASN for Local Network Gateway is required to be 65515.
Enable BGP on the Local Network Gateway
To enable BGP on the local network gateway object also navigate to Settings -> Configuration and switch the BGP Settings toggle button to Yes.
Further I will now remove the configured static routes on the local gateway object in Azure as they will be advertised from now by BGP on both sides.
When enabling BGP we need to enter the Autonomous system number (ASN) from on-premise configured on Juniper and also the BGP Peer IP address .
The static routes we now have removed besides the host address for our BGP Peer IP address.
If you plan to use this local network gateway in a BGP-enabled connection, then the minimum prefix you need to declare is the host address of your BGP Peer IP address on your VPN device.
Don’t use a BGP peer IP inside the Azure VNet address space (172.17.0.0/16) on your Juniper side.
Set your Juniper BGP peer IP to something like 10.255.255.1, finally a host address that you control, is not inside any Azure VNet CIDR, is routed over the IPSec tunnel and can be included in the local network gateway without causing overlap.
Enable BGP on the Connection
No finally in Azure we also need to enable BGP on the connection object. So here navigate also to Settings -> Configuration and switch the BGP toggle button to Enabled.
That’s all on Azure side, next we enable and configure BGP on Juniper vSRX3.
Enable BGP on Juniper vSRX3
Add second BGP-friendly IP on the st0.0 tunnel interface used by BGP
The tunnel interface has already assigned the IP address 172.17.9.253 to establish the ipsec phase 2 tunnel with Azure (IP 172.17.9.254) as shown in my previous post.
We will now assign a second IP address we used dedicated for the BGP session and already set previously on the Azure local network gateway object.
Azure requires BGP peering to occur over IP addresses that do not overlap with its gateway subnet.
Don’t use a BGP peer IP inside the Azure VNet address space (172.17.0.0/16) on your Juniper side.
Set your Juniper BGP peer IP to something like 10.255.255.1 (In my case already set previously on the Azure local network gateway object), finally a host address that you control, is not inside any Azure VNet CIDR, is routed over the IPSec tunnel and can be included in the local network gateway without causing overlap.
set interfaces st0.0 family inet address 10.255.255.1/32
As mentioned previously set on the local network gateway object in Azure.
Loopback Interface and Router ID
The loopback interface (lo0) always exists by default on Juniper devices. It’s a special internal interface used by the routing engine, you can optionally configure its logical units and IP addresses but usually not necessary and done automatically.
We also didn’t have to configure it here explicitly to work with Azure.
Verify the looback interface by running.
show interfaces lo0
Set BGP group and peer
set protocols bgp group AZURE type external set protocols bgp group AZURE peer-as 65515 # Azure ASN set protocols bgp group AZURE neighbor 172.17.9.254 # Azure BGP peer IP
The BGP peer IP and ASN from Azure we will find on the virtual network gateway in Azure.
Define your local ASN
set routing-options autonomous-system 65505 # Your ASN
Must match with the one we set on the local network gateway object in Azure.
Enable BGP on st0.0 tunnel interface
This command tells the Juniper vSRX3 which local IP address to use when establishing the BGP session with its peer, in my case here, Azure’s BGP peer IP (172.17.9.254).
We will set here the IP address we previously added as second IP on the st0.0 tunnel interface.
It sets the source IP for BGP TCP connections (on port tcp 179) originating from the Juniper firewall toward Azure.
Without this line, Junos would automatically pick the IP of the egress interface used to reach the BGP peer. This might be ambiguous or incorrect, especially on st0.0, which can have multiple IP addresses (as in my case here: both 172.17.9.253/30 used to establish ipsec phase2 tunnel and 10.255.255.1/32 used for the BGP session).
set protocols bgp group AZURE local-address 10.255.255.1 # Juniper st0.0 IP second IP we added
Create a Export Policy
The export policy in Juniper BGP configuration defines which routes your device advertises to its BGP peers, in this case, Azure.
term 1 from protocol [ static direct ] ==> Matches routes learned via static or direct means. These are your local networks/subnets (e.g., LANs, loopbacks, default routes, etc.)
term 1 then accept ==> Advertises all matched routes (static and direct) to Azure
term 2 then reject ==> A fallback: reject any other routes that don’t match the above (like dynamic/BGP-learned routes from other neighbors)
set policy-options policy-statement EXPORT-TO-AZURE term 1 from protocol [ static direct ] set policy-options policy-statement EXPORT-TO-AZURE term 1 then accept set policy-options policy-statement EXPORT-TO-AZURE term 2 then reject # Advertise route ID IP optional set policy-options policy-statement EXPORT-TO-AZURE term 3 from route-filter 10.0.0.5/32 exact set policy-options policy-statement EXPORT-TO-AZURE term 3 then accept # Apply the policy to the BGP Group set protocols bgp group AZURE export EXPORT-TO-AZURE
And finally commit the configuration.
commit
We do not need an import policy on Juniper to accept Azure’s advertised routes, by default JunOS accepts all BGP routes unless you configure an explicit import policy to filter them.
When you might need an import policy, filter or restrict prefixes received from Azure (e.g., only accept 172.17.0.0/16 and reject others)
set policy-options policy-statement IMPORT-FROM-AZURE term 1 from route-filter 172.17.0.0/16 exact set policy-options policy-statement IMPORT-FROM-AZURE term 1 then accept set policy-options policy-statement IMPORT-FROM-AZURE term 2 then reject set protocols bgp group AZURE import IMPORT-FROM-AZURE
Verify BGP is working
Below some commands we can use to verify if BGP works correctly.
show bgp summary
This command show all relevant information about the BGP session.
A BGP session is a TCP connection (usually over port 179) established between two BGP speaking routers aka BGP peers or neighbors for the purpose of exchanging routing information.
show bgp summary
show bgp neighbor
This command displays detailed information about a BGP neighbor in Junos OS.
show bgp neighbor 172.17.9.254
Show advertised Routes by Juniper to Azure
This command shows the routes that your Juniper device is advertising to the BGP peer at IP 172.17.9.254 (here the Azure VPN Gateway).
show route advertising-protocol bgp 172.17.9.254
Show advertised Routes by Azure
This command displays all routes learned via BGP on your Juniper vSRX, meaning these are routes received from BGP peers (here from Azure).
show route protocol bgp
Show advertised Routes by Juniper using the Azure Portal
On the virtual network gateway under Monitoring -> BGP peers.
Here we will see all routes Azure learned including my two on-premise subnets (10.0.0.0/24 and 192.168.2.0/24 plus the host address of the BGP peer IP).
On the virtual machines Network interface -> Help -> Effective routes we will also see these advertised routes.
Or by using Azure PowerShell.
PS> Get-AzVirtualNetworkGatewayLearnedRoute -ResourceGroupName "rsg-matrix-weu-spoke" -VirtualNetworkGatewayName "VNet-GW"
Clear BGP session to reestablish it
To clear (reset) the BGP session with a specific neighbor on a Juniper vSRX device, use the following operational command.
This will tear down and re-establish the BGP session with the neighbor 172.17.9.254. Useful when you’ve made config changes or want to force re-advertisement of routes.
clear bgp neighbor 172.17.9.254
If you just want to refresh routing information without tearing down the session, use:
clear bgp neighbor 172.17.9.254 soft
Or the following command which lets routing information persist across a session reset without full disruption to the forwarding plane.
clear bgp neighbor 172.17.9.254 graceful
Troubleshooting
In case the BGP is not working as expected we can first enable BGP debug logging on Juniper and then using the monitor command to analyze the logs.
Enable BGP Debug Logging
set protocols bgp traceoptions file bgp-debug size 1m files 3 set protocols bgp traceoptions flag all
Start Debugging
monitor start bgp-debug show log bgp-debug | last 50
Checking all active sessions where the destination port is TCP 179 (i.e., BGP sessions)
show security flow session destination-port 179
To monitor traffic on the st0.0 interface matching a specific host (e.g., 172.16.x.x), use this command:
monitor traffic interface st0.0 matching "host 172.16.x.x"
Links
BGP Configuration Overview
https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/task/routing-protocol-bgp-security-configuring.htmlSRX Series Firewalls
https://www.juniper.net/us/en/products/security/srx-series.htmlJuniper vSRX Setup & Initial Configuration Guide
https://journey2theccie.wordpress.com/2021/02/04/juniper-vsrx-setup-initial-configuration-guide/
