Tailspin Toys is deploying an active-active VPN Gateway in Azure for high availability and BGP peering with their on-prem edge routers. The network team created two custom BGP peer IP addresses for the Azure side that come from an IP range outside the gateway subnet (they used 10.10.100.0/29 while the gateway subnet is 10.10.0.0/27). After deployment the BGP sessions never establish. What is the most likely cause and the correct fix?

For an Azure VPN Gateway, custom BGP APIPA addresses (169.254.21.0/30 or 169.254.22.0/30) are automatically assigned by default. If you choose to configure custom BGP peer IP addresses, these addresses must be allocated from the GatewaySubnet range. The provided custom BGP peer IP addresses (10.10.100.0/29) are outside the GatewaySubnet (10.10.0.0/27), which is why the BGP sessions failed to establish. Incorrect options: BGP peer IP addresses for Azure VPN Gateway are private IPs, not public. Active-active VPN Gateways inherently have two instances, each requiring its own BGP peer IP for redundancy. BGP is fully supported and recommended for active-active VPN Gateways to provide dynamic routing and high availability.