Virtual Network Gateway should enable active-active configuration

High Azure General virtualnetworkgateways-virtual-network-gateway-ena

Applies to

Microsoft.Network/virtualNetworkGateways

What CGPulse checks

A resource passes this rule when activeActive must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable active-active mode for high availability and redundant VPN connections. In Azure Portal: VNet Gateway > Configuration > enable Active-active mode. See: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

Careful: Enabling active-active requires a second public IP and may cause brief connectivity interruption

CLI

az network vnet-gateway update --ids "{id}" --set activeActive=true

Terraform

resource "azurerm_virtual_network_gateway" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  type                = "Vpn"
  vpn_type            = "RouteBased"
  active_active       = true
  sku                 = "VpnGw2"
  ip_configuration {
    name                          = "primary"
    public_ip_address_id          = azurerm_public_ip.primary.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
  ip_configuration {
    name                          = "secondary"
    public_ip_address_id          = azurerm_public_ip.secondary.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan