You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: includes/vpn-gateway-faq-ipsecikepolicy-include.md
+18-26Lines changed: 18 additions & 26 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: include file
3
3
author: cherylmc
4
4
ms.service: vpn-gateway
5
-
ms.date: 05/25/2022
5
+
ms.date: 01/30/2023
6
6
ms.author: cherylmc
7
7
---
8
8
### Is Custom IPsec/IKE policy supported on all Azure VPN Gateway SKUs?
@@ -19,26 +19,11 @@ No, you must specify all algorithms and parameters for both IKE (Main Mode) and
19
19
20
20
### What are the algorithms and key strengths supported in the custom policy?
21
21
22
-
The following table lists the supported cryptographic algorithms and key strengths configurable by the customers. You must select one option for every field.
> * DHGroup2048 & PFS2048 are the same as Diffie-Hellman Group **14** in IKE and IPsec PFS. See [Diffie-Hellman Groups](#DH) for the complete mappings.
38
-
> * For GCMAES algorithms, you must specify the same GCMAES algorithm and key length for both IPsec Encryption and Integrity.
39
-
> * IKEv2 Main Mode SA lifetime is fixed at 28,800 seconds on the Azure VPN gateways.
40
-
> * QM SA Lifetimes are optional parameters. If none was specified, default values of 27,000 seconds (7.5 hrs) and 102400000 KBytes (102GB) are used.
41
-
> * UsePolicyBasedTrafficSelector is an option parameter on the connection. See the next FAQ item for "UsePolicyBasedTrafficSelectors".
22
+
The following table lists the supported cryptographic algorithms and key strengths that you can configure. You must select one option for every field.
23
+
24
+
[!INCLUDE [Algorithm and keys table](vpn-gateway-ipsec-ike-algorithm-include.md)]
### Does everything need to match between the Azure VPN gateway policy and my on-premises VPN device configurations?
44
29
@@ -52,9 +37,10 @@ Your on-premises VPN device configuration must match or contain the following al
52
37
* PFS Group
53
38
* Traffic Selector (*)
54
39
55
-
The SA lifetimes are local specifications only, don't need to match.
40
+
The SA lifetimes are local specifications only. They don't need to match.
56
41
57
42
If you enable **UsePolicyBasedTrafficSelectors**, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any. For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
43
+
58
44
* 10.1.0.0/16 <====> 192.168.0.0/16
59
45
* 10.1.0.0/16 <====> 172.16.0.0/16
60
46
* 10.2.0.0/16 <====> 192.168.0.0/16
@@ -84,7 +70,7 @@ Yes, once a custom policy is specified on a connection, Azure VPN gateway will o
84
70
85
71
### If I remove a custom IPsec/IKE policy, does the connection become unprotected?
86
72
87
-
No, the connection will still be protected by IPsec/IKE. Once you remove the custom policy from a connection, the Azure VPN gateway reverts back to the [default list of IPsec/IKE proposals](../articles/vpn-gateway/vpn-gateway-about-vpn-devices.md) and restart the IKE handshake again with your on-premises VPN device.
73
+
No, the connection will still be protected by IPsec/IKE. Once you remove the custom policy from a connection, the Azure VPN gateway reverts back to the [default list of IPsec/IKE proposals](../articles/vpn-gateway/vpn-gateway-about-vpn-devices.md#RouteBasedOffers) and restart the IKE handshake again with your on-premises VPN device.
88
74
89
75
### Would adding or updating an IPsec/IKE policy disrupt my VPN connection?
90
76
@@ -104,7 +90,10 @@ Yes. A VNet-to-VNet tunnel consists of two connection resources in Azure, one fo
104
90
105
91
### What is the default DPD timeout value? Can I specify a different DPD timeout?
106
92
107
-
The default DPD timeout is 45 seconds. You can specify a different DPD timeout value on each IPsec or VNet-to-VNet connection between 9 seconds to 3600 seconds.
93
+
The default DPD timeout is 45 seconds. You can specify a different DPD timeout value on each IPsec or VNet-to-VNet connection, from 9 seconds to 3600 seconds.
94
+
95
+
> [!NOTE]
96
+
> The default value is 45 seconds on Azure VPN gateways. Setting the timeout to shorter periods will cause IKE to rekey more aggressively, causing the connection to appear to be disconnected in some instances. This may not be desirable if your on-premises locations are farther away from the Azure region where the VPN gateway resides, or when the physical link condition could incur packet loss. The general recommendation is to set the timeout between **30 and 45** seconds.
108
97
109
98
### Does custom IPsec/IKE policy work on ExpressRoute connection?
110
99
@@ -131,6 +120,9 @@ If your static routing or route based IKEv1 connection is disconnecting at routi
131
120
132
121
If your connection is reconnecting at random times, follow our [troubleshooting guide](../articles/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-disconnected-intermittently.md).
133
122
134
-
### Where can I find more configuration information for IPsec?
123
+
### Where can I find configuration information and steps?
124
+
125
+
See the following articles for more information and configuration steps.
135
126
136
-
See [Configure IPsec/IKE policy for S2S or VNet-to-VNet connections](../articles/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell.md).
127
+
*[Configure IPsec/IKE policy for S2S or VNet-to-VNet connections - Azure portal](../articles/vpn-gateway/ipsec-ike-policy-howto.md)
128
+
*[Configure IPsec/IKE policy for S2S or VNet-to-VNet connections - Azure PowerShell](../articles/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell.md)
Copy file name to clipboardExpand all lines: includes/vpn-gateway-ipsec-ike-requirements-include.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,9 +28,9 @@ ms.topic: include
28
28
29
29
* IKE Main Mode SA lifetime is fixed at 28,800 seconds on the Azure VPN gateways.
30
30
31
-
* If you set **UsePolicyBasedTrafficSelectors** to $True on a connection, it will configure the Azure VPN gateway to connect to policy-based VPN firewall on premises. If you enable PolicyBasedTrafficSelectors, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any.
31
+
*'UsePolicyBasedTrafficSelectors' is an optional parameter on the connection. If you set **UsePolicyBasedTrafficSelectors** to $True on a connection, it will configure the Azure VPN gateway to connect to policy-based VPN firewall on premises. If you enable PolicyBasedTrafficSelectors, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any.
32
32
33
-
For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
33
+
For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
0 commit comments