Add IPv6 support for private peering

Sign in to the Azure portal

From a web browser, sign in to the Azure portal.

• Install the latest version of the CLI commands (2.0 or later). For information about installing the CLI commands, see Install the Azure CLI and Get Started with Azure CLI.

The steps and examples in this article use Azure PowerShell Az modules. To install the Az modules locally on your computer, see Install Azure PowerShell. To learn more about the new Az module, see Introducing the new Azure PowerShell Az module. PowerShell cmdlets are updated frequently. If you are not running the latest version, the values specified in the instructions may fail. To find the installed versions of PowerShell on your system, use the Get-Module -ListAvailable Az cmdlet.

1. Create an ExpressRoute circuit or navigate to the existing circuit you want to change.

2. Select the Azure private peering configuration.

3. Add an IPv6 Private Peering to your existing IPv4 Private Peering configuration by selecting "Both" for Subnets, or only enable IPv6 Private Peering on your new circuit by selecting "IPv6". Provide a pair of /126 IPv6 subnets that you own for your primary link and secondary links. From each of these subnets, you assign the first usable IP address to your router as Microsoft uses the second usable IP for its router. Save your peering configuration once you defined all parameters.

   

4. After the configuration is accepted successfully, you should see something similar to the following example.

   

1. Create an ExpressRoute circuit or use an existing circuit. View the circuit details by running the following command:

   az network express-route show --resource-group "<ExpressRouteResourceGroup>" --name "<MyCircuit>"
   

2. View the private peering configuration for the circuit by running the following command:

   az network express-route peering show -g "<ExpressRouteResourceGroup>" --circuit-name "<MyCircuit>" --name AzurePrivatePeering
   

3. Add an IPv6 Private Peering to your existing IPv4 Private Peering configuration. Provide a pair of /126 IPv6 subnets that you own for your primary link and secondary links. From each of these subnets, you assign the first usable IP address to your router as Azure uses the second usable IP for its router.

   az network express-route peering update -g "<ExpressRouteResourceGroup>" --circuit-name "<MyCircuit>" --name AzurePrivatePeering --ip-version ipv6 --primary-peer-subnet "<X:X:X:X/126>" --secondary-peer-subnet "<Y:Y:Y:Y/126>"
   

1. Create an ExpressRoute circuit or use an existing circuit. Retrieve the circuit by running the Get-AzExpressRouteCircuit command:

   $ckt = Get-AzExpressRouteCircuit -Name "ExpressRouteARMCircuit" -ResourceGroupName "ExpressRouteResourceGroup"
   

2. Retrieve the private peering configuration for the circuit by running Get-AzExpressRouteCircuitPeeringConfig:

   Get-AzExpressRouteCircuitPeeringConfig -Name "AzurePrivatePeering" -ExpressRouteCircuit $ckt
   

3. Add an IPv6 Private Peering to your existing IPv4 Private Peering configuration. Provide a pair of /126 IPv6 subnets that you own for your primary link and secondary links. From each of these subnets, you assign the first usable IP address to your router as Azure uses the second usable IP for its router.

   Note

   The peer ASN and VlanId should match those in your IPv4 Private Peering configuration.

   Set-AzExpressRouteCircuitPeeringConfig -Name "AzurePrivatePeering" -ExpressRouteCircuit $ckt -PeeringType AzurePrivatePeering -PeerASN 100 -PrimaryPeerAddressPrefix "3FFE:FFFF:0:CD30::/126" -SecondaryPeerAddressPrefix "3FFE:FFFF:0:CD30::4/126" -VlanId 200 -PeerAddressType IPv6
   
   Set-AzExpressRouteCircuit -ExpressRouteCircuit $ckt
   

4. After the configuration is saved successfully, get the circuit again by running the Get-AzExpressRouteCircuit command. The response should look similar to the following example:

   Name                             : ExpressRouteARMCircuit
   ResourceGroupName                : ExpressRouteResourceGroup
   Location                         : chinaeast
   Id                               : /subscriptions/***************************/resourceGroups/ExpressRouteResourceGroup/providers/Microsoft.Network/expressRouteCircuits/ExpressRouteARMCircuit
   Etag                             : W/"################################"
   ProvisioningState                : Succeeded
   Sku                              : {
                                        "Name": "Standard_MeteredData",
                                        "Tier": "Standard",
                                        "Family": "MeteredData"
                                      }
   CircuitProvisioningState         : Enabled
   ServiceProviderProvisioningState : Provisioned
   ServiceProviderNotes             :
   ServiceProviderProperties        : {
                                        "ServiceProviderName": "Equinix",
                                        "PeeringLocation": "Washington DC",
                                        "BandwidthInMbps": 50
                                      }
   ExpressRoutePort                 : null
   BandwidthInGbps                  :
   Stag                             : 29
   ServiceKey                       : **************************************
   Peerings                         : [
                                        {
                                          "Name": "AzurePrivatePeering",
                                          "Etag": "W/\"facc8972-995c-4861-a18d-9a82aaa7167e\"",
                                          "Id": "/subscriptions/***************************/resourceGroups/ExpressRouteResourceGroup/providers/Microsoft.Network/expressRouteCircuits/ExpressRouteARMCircuit/peerings/AzurePrivatePeering",
                                          "PeeringType": "AzurePrivatePeering",
                                          "State": "Enabled",
                                          "AzureASN": 12076,
                                          "PeerASN": 100,
                                          "PrimaryPeerAddressPrefix": "192.168.15.16/30",
                                          "SecondaryPeerAddressPrefix": "192.168.15.20/30",
                                          "PrimaryAzurePort": "",
                                          "SecondaryAzurePort": "",
                                          "VlanId": 200,
                                          "ProvisioningState": "Succeeded",
                                          "GatewayManagerEtag": "",
                                          "LastModifiedBy": "Customer",
                                          "Ipv6PeeringConfig": {
                                            "State": "Enabled",
                                            "PrimaryPeerAddressPrefix": "3FFE:FFFF:0:CD30::/126",
                                            "SecondaryPeerAddressPrefix": "3FFE:FFFF:0:CD30::4/126"
                                          },
                                          "Connections": [],
                                          "PeeredConnections": []
                                        },
                                      ]
   Authorizations                   : []
   AllowClassicOperations           : False
   GatewayManagerEtag               :
   

Follow these steps if you have an existing environment of Azure resources that you would like to use your IPv6 Private Peering with.

1. Navigate to the virtual network that your ExpressRoute circuit is connected to.

2. Navigate to the Address space tab and add an IPv6 address space to your virtual network. Save your address space.

   

3. Navigate to the Subnets tab and select the GatewaySubnet. Check Add IPv6 address space and provide an IPv6 address space for your subnet. The gateway IPv6 subnet should be /64 or larger. Save your configuration once you defined all parameters.

   

4. If you have an existing zone-redundant gateway, run the following command in PowerShell to enable IPv6 connectivity (note that it can take up to 1 hour for changes to reflect). Otherwise, create the virtual network gateway using any SKU and a Standard, Static public IP address. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that this option is only available for circuits using ExpressRoute Direct).

   $gw = Get-AzVirtualNetworkGateway -Name "GatewayName" -ResourceGroupName "ExpressRouteResourceGroup"
   Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw
   

1. Add an IPv6 address space to the virtual network that your ExpressRoute circuit is connected to.

   az network vnet update -g "<MyResourceGroup>" -n "<MyVNet>" --address-prefixes "X:X:X:X::/64"
   

2. Add IPv6 address space to your gateway subnet. The gateway IPv6 subnet should be /64 or larger.

   az network vnet subnet update -g "<MyResourceGroup>" -n "<MySubnet>" -vnet-name "<MyVNet>" --address-prefixes "10.0.0.0/26", "X:X:X:X::/64"
   

3. If you have an existing zone-redundant gateway, run the following to enable IPv6 connectivity (note that it can take up to 1 hour for changes to reflect). Otherwise, create the virtual network gateway using any SKU. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that this feature is only available for circuits using ExpressRoute Direct).

   az network vnet-gateway update --name "<GatewayName>" --resource-group "<MyResourceGroup>"
   

1. Retrieve the virtual network that your ExpressRoute circuit is connected to.

   $vnet = Get-AzVirtualNetwork -Name "VirtualNetwork" -ResourceGroupName "ExpressRouteResourceGroup"
   

2. Add an IPv6 address space to your virtual network.

   $vnet.AddressSpace.AddressPrefixes.add("ace:daa:daaa:deaa::/64")
   Set-AzVirtualNetwork -VirtualNetwork $vnet
   

3. Add IPv6 address space to your gateway subnet. The gateway IPv6 subnet should be /64 or larger.

   Set-AzVirtualNetworkSubnetConfig -Name GatewaySubnet -VirtualNetwork $vnet -AddressPrefix "10.0.0.0/26", "ace:daa:daaa:deaa::/64"
   Set-AzVirtualNetwork -VirtualNetwork $vnet
   

4. If you have an existing zone-redundant gateway, run the following to enable IPv6 connectivity (note that it can take up to 1 hour for changes to reflect). Otherwise, create the virtual network gateway using any SKU. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that this feature is only available for circuits using ExpressRoute Direct).

   $gw = Get-AzVirtualNetworkGateway -Name "GatewayName" -ResourceGroupName "ExpressRouteResourceGroup"
   Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gw
   

1. Create a dual-stack virtual network with both IPv4 and IPv6 address space. For more information, see Create a virtual network.

2. Create the dual-stack gateway subnet.

3. Create the virtual network gateway using any SKU and a Standard, Static public IP address. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that this option is only available for circuits using ExpressRoute Direct). NOTE: Use the PowerShell instructions for this step as the Azure portal experience is still under development.

4. Link your virtual network to your ExpressRoute circuit.

1. Create a dual-stack virtual network with both IPv4 and IPv6 address space. For more information, see Create a virtual network.

2. Create the dual-stack gateway subnet.

3. Create the virtual network gateway using any SKU. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that feature is only available for circuits using ExpressRoute Direct).

4. Link your virtual network to your ExpressRoute circuit.

1. Create a dual-stack virtual network with both IPv4 and IPv6 address space. For more information, see Create a virtual network.

2. Create the dual-stack gateway subnet.

3. Create the virtual network gateway using any SKU. If you plan to use FastPath, use UltraPerformance or ErGw3AZ (note that this feature is only available for circuits using ExpressRoute Direct).

4. Link your virtual network to your ExpressRoute circuit.