Adding a VPN Gateway to an ExpressRoute-connected subnet

@alexnetsec
Thank you for reaching out.

I understand that you wish to add an Azure VPN Gateway to a subnet where Azure Express Route is already configured. The subnet size is /24.

Based on your statement above.

Although the subnet is bigger than the requirements, the VPN Gateway creation process doesn't allow me to select it.

Based on the limitation here The gateway subnet must be /27 or a shorter prefix, such as /26, /25, or you receive an error message when you add the virtual network gateway. Which is true in your case. Can you please validate the points below and see if that helps in resolving the issue.

In order to configure this, you need to add additional Virtual network gateway of type VPN as shown here. Just take a note of following points

• The GatewaySku is only supported for VpnGw1, VpnGw2, VpnGw3, Standard, and HighPerformance VPN gateways.
• ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU
• The VpnType must be RouteBased
• If you want to enable connectivity between one of your local networks that is connected to ExpressRoute and another of your local network that is connected to a site-to-site VPN connection, you need to set up Azure Route Server.
• ExpressRoute co-existence with VPN gateway is supported, but only for IPv4 traffic. IPv6 traffic isn't supported for VPN gateways.

Hope this helps! Please let me know if you have any questions. Thank you!

Many thanks for your quick answer. To follow-up on the requirement, the local routing is now done on the firewall to the ExpressRoute next-hop and the idea is to create an IPSEC VPN on the same firewall to modify the routing from the ER to the VPN. I will check the SKU requirement. All traffic is IPV4. From all this, it's not clear if we need a Route Server or not. Technically, this is the same on-premises endpoint which would have ER and Route-based VPN connectivity concurrently until we validate VPN and can remove the ER component.

@alexnetsec
Thank you for getting back and apologies for the delay here. Just wanted to do a quick follow and check if Changing the VPN Gateway SKU helped in resolving the issue?

As you are validating the VPN Gateway and removing the Express route, I too do not think there will be a requirement to implement a route server. If it helps you can take a look at this doc for difference in routing for Express Route and VPN.