Skip to main content
How Can We Help?

Search for answers or browse our knowledge base.

Azure Site to Site VPN

Created On
byAndrew Binning
You are here:
< Back

Instructions

  1. Search (top) for “Virtual Network Gateway” and click “Add” (top menu)
  2. On the “Create Virtual Network Gateway” screen
    1. Subscription: Select correct subscription
    2. Name: (AzServer)-vng Example: Hosting-vng
    3. Region: Select same as (AzServer)
    4. Gateway Type: VPN
    5. VPN type: Route-based
    6. SKU: VpnGw1
    7. Virtual Network: Select same virtual network as (AzServer)
    8. Subnet for new vng
             -change range from 10.0.x.0/24
             -change range from 10.0.x-1.0/23
             -Gateway subnet address range = 10.0.x-1.0/24
             -You may need to change the VNET address space from /24 to /23
    9. Public IP address: Create new
    10. Public IP address name: (AzServer)-vng-ip Example: Hosting-vng-ip
    11. Enable active-active mode: Disabled
    12. Configure BGP ASN: Disabled
    13. Click “Review + create” button
  3. Search (top) for “Local network gateway” and click “Add” (top menu)
    1. Name: (CustomerName)01-lng Example: Anschutz01-lng
    2. IP address: Enter information provided by customer
    3. Address space: Enter information provided by customer
    4. Subscription: Select correct subscription
    5. Resource group: Select same as (AzServer)
    6. Location: Select same as (AzServer)
    7. Click “Create” button
  4. Go to newly created Virtual Network Gateway (AzVNG)
  5. Select “Connections” (left side) and click “Add” OR use the script below
  6. On the “Add connection” screen
    1. Name: (AzVNG)-(AzLNG)-vpn Example: Hosting-Anschutz01-vpn
    2. Connection type: Site-to-site (IPsec)
    3. Virtual network gateway: Select (AzVNG)
    4. Local network gateway: Select (AzLNG)
    5. Shared Key (PSK): Enter key
    6. Click “OK”
  7. Done

 

  • When creating a Virtual Network Gateway, it can take about 30 minutes.
  • When entering the Shared Key (or Pre-Shared Key) for the Connection, it should be at least 16 characters and encrypted.
#https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell#managepolicy
#https://portal.azure.com/#cloudshell/
$RG1           = "PetroLegacy-rg"
$Location1     = "South Central US"
$GWName1       = "PetroLegcay-vng"
$Connection16  = "PetroLegacy-Field-vpn"
$LNGName6      = "PetroLegacy-lng"
######################################## 
$ipsecpolicy6 = New-AzIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA256 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA256 -PfsGroup None -SALifeTimeSeconds 28800 -SADataSizeKilobytes 102400000
$vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1  -ResourceGroupName $RG1
$lng6 = Get-AzLocalNetworkGateway  -Name $LNGName6 -ResourceGroupName $RG1
#Create VNG->LNG Connection
New-AzVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng6 -Location $Location1 -ConnectionType IPsec -IpsecPolicies $ipsecpolicy6 -SharedKey 'Pre-Shared-key'