--- title: "Setting Up Anycast DNS on NIOS-X Servers in Azure" canonical: "https://docs.infoblox.com/space/BloxOneInfrastructure/1673953535/Setting%20Up%20Anycast%20DNS%20on%20NIOS-X%20Servers%20in%20Azure" format: markdown --- This topic provides step-by-step instructions for setting up Anycast DNS on NIOS-X servers in Azure. For information about how to set up Cloud Anycast service, see *[Creating Anycast Services](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/149815516)*. # Prerequisites Before configuring anycast DNS, ensure that you have set up and tested the following: - Establish a BGP session between the SD-WAN router and the Azure Virtual Gateway using the VirtualGatewayBGPSession. This enables the exchange of VNet subnet routes between the SD-WAN router and the Virtual Gateway. - Deploy the NIOS-X appliance within the VNet, ensuring it is reachable via the exchanged subnet routes. - Configure a BGP session between the SD-WAN router and the NIOS-X NIC IP using the BloxoneAnycastBGPSession. This facilitates the advertisement and exchange of anycast routes between the SD-WAN router and NIOS-X server. > Macro (drawio) # Setting Up Anycast DNS the NIOS-X Server on Azure > 📝 You can follow the following setup instructions for all Azure regions hosting the NIOS-X server with anycast. To set up anycast DNS, complete the following: 1. Ensure that the following are set up properly and functional: - VNet and all dependent objects are created. - A VPN gateway is properly deployed. - The Public IP addresses are obtained. 2. Set up an SD-WAN router to establish tunnels to the VPN gateway. 1. The following are examples of ipsec.conf for a Strongswan IPsec client. You will have to apply equivalent configurations for your SDWAN router: conn ha1       left=172.16.0.0       right=172.16.0.1       authby=psk       auto=start       forceencaps=yes       leftsubnet=0.0.0.0/0       rightsubnet=0.0.0.0/0       keyexchange=ikev2       dpdaction=restart       closeaction=restart       ike=aes256-sha512-modp2048       esp=aes256-sha512-modp2048       type=tunnel       leftupdown=/udw  conn ha2       left=172.16.0.2       right=172.16.0.3       authby=psk       auto=start       forceencaps=yes       leftsubnet=0.0.0.0/0       rightsubnet=0.0.0.0/0       keyexchange=ikev2       dpdaction=restart       closeaction=restart       ike=aes256-sha512-modp2048       esp=aes256-sha512-modp2048       type=tunnel       leftupdown=/udw 2. The following is an example of ipsec.secrets: 0.0.0.0 : PSK "the secret". 3. Add static routes to to BGP peer IP addresses of the VPN tunnel:  dev vti1 scope link  dev vti2 scope link 4. Verify the tunnels: ip tunnel show  vti1: ip/ip remote 172.16.0.1 local 172.16.0.2 ttl inherit key 1  vti2: ip/ip remote 172.16.0.3 local 172.16.0.2 ttl inherit key 2 3. Establish BGP session from the SD-WAN router to the VPN Gateway. router bgp 65000    bgp router-id 10.0.0.1    neighbor remote-as 10    neighbor remote-as 65515    neighbor remote-as 65515 4. Configure IP rules on the SD-WAN router: ip rule  2: from all to 192.168.0.100 dport 67 lookup 10  18: from all to 192.168.0.100 lookup 10  19: from all to 10.0.0.4 dport 53 lookup 9  20: from all lookup local  220: from all lookup 220  32766: from all lookup main  32767: from all lookup default    ip route show table 10  default dev vti2 scope link src 10.0.0.1 5. Add static route on VNET GatewaySubnet by configuring the VNET GatewaySubnet to forward packets destined to the Anycast IP to the Virtual Appliance IP (Azure On-Prem VNET IP). 6. Ensure IP forwarding is enabled on the NIC of the Azure NIOS-X server. 7. Modify the NSG to allow inbound packets on port 53. 8. Configure the route map on the SDWAN router. The following commands shows how to perform these functions using an FRR routing stack as an example. You will have to apply equivalent configurations for your SDWAN router. - Define prefix lists and route maps to filter and permit specific routes. - BLOCK-ROUTE denies the Anycast IP subnet and permits all other routes. - Apply route-map BGP-OUT-FILTER to neighbors Azure BGP Peer IP1 and Azure BGP Peer IP2. router bgp 65000    bgp router-id 10.0.0.1    neighbor remote-as 10    neighbor remote-as 65515    neighbor remote-as 65515    address-family ipv4 unicast      neighbor route-map BGP-OUT-FILTER out     neighbor route-map BGP-OUT-FILTER out    exit-address-family  ip prefix-list BLOCK-ROUTE seq 5 deny ip prefix-list BLOCK-ROUTE seq 10 permit 0.0.0.0/0 le 32  route-map BGP-OUT-FILTER deny 10    match ip address prefix-list BLOCK-ROUTE  route-map BGP-OUT-FILTER permit 20 9. Ensure that Anycast and DNS are already enabled on the NIOS-X server. 10. On the SD-WAN router, verify the BGP session with the NIOS-X server is up and the router receives the Anycast IP via BGP.