Skip to content

Commit 8b675fa

Browse files
denreadenrea
authored
Merge pull request #223834 from cherylmc/ipsecps
Ipsecps
2 parents 0e0141a + 999f926 commit 8b675fa

File tree

4 files changed

+208
-252
lines changed

4 files changed

+208
-252
lines changed

‎articles/vpn-gateway/TOC.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,7 +267,7 @@
267267
href: vpn-gateway-download-vpndevicescript.md
268268
- name: 'Sample: Cisco ASA device (IKEv2/no BGP)'
269269
href: vpn-gateway-3rdparty-device-config-cisco-asa.md
270-
- name: Configure IPsec/IKE policies on connections
270+
- name: Configure custom IPsec/IKE connection policies
271271
items:
272272
- name: Azure portal
273273
href: ipsec-ike-policy-howto.md

‎articles/vpn-gateway/ipsec-ike-policy-howto.md

Lines changed: 60 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -1,65 +1,48 @@
11
---
2-
title: 'IPsec/IKE policy for S2S VPN & VNet-to-VNet connections: Azure portal'
2+
title: 'Configure custom IPsec/IKE connection policies for S2S VPN & VNet-to-VNet: Azure portal'
33
titleSuffix: Azure VPN Gateway
4-
description: Learn how to configure IPsec/IKE policy for S2S or VNet-to-VNet connections with Azure VPN Gateways using the Azure portal.
4+
description: Learn how to configure IPsec/IKE custom policy for S2S or VNet-to-VNet connections with Azure VPN Gateways using the Azure portal.
55
services: vpn-gateway
66
author: cherylmc
77

88
ms.service: vpn-gateway
99
ms.topic: how-to
10-
ms.date: 01/12/2023
10+
ms.date: 01/17/2023
1111
ms.author: cherylmc
1212

1313
---
14-
# Configure IPsec/IKE policy for S2S VPN and VNet-to-VNet connections: Azure portal
14+
# Configure custom IPsec/IKE connection policies for S2S VPN and VNet-to-VNet: Azure portal
1515

1616
This article walks you through the steps to configure IPsec/IKE policy for VPN Gateway Site-to-Site VPN or VNet-to-VNet connections using the Azure portal. The following sections help you create and configure an IPsec/IKE policy, and apply the policy to a new or existing connection.
1717

18-
## <a name="about"></a>About IPsec and IKE policy parameters
19-
20-
IPsec and IKE protocol standard supports a wide range of cryptographic algorithms in various combinations. Refer to [About cryptographic requirements and Azure VPN gateways](vpn-gateway-about-compliance-crypto.md) to see how this can help ensure cross-premises and VNet-to-VNet connectivity to satisfy your compliance or security requirements.
21-
22-
This article provides instructions to create and configure an IPsec/IKE policy, and apply it to a new or existing VPN gateway connection.
23-
24-
### Considerations
25-
26-
* IPsec/IKE policy only works on the following gateway SKUs:
27-
* ***VpnGw1~5 and VpnGw1AZ~5AZ***
28-
* ***Standard*** and ***HighPerformance***
29-
* You can only specify ***one*** policy combination for a given connection.
30-
* You must specify all algorithms and parameters for both IKE (Main Mode) and IPsec (Quick Mode). Partial policy specification isn't allowed.
31-
* Consult with your VPN device vendor specifications to ensure the policy is supported on your on-premises VPN devices. S2S or VNet-to-VNet connections can't establish if the policies are incompatible.
32-
3318
## <a name ="workflow"></a>Workflow
3419

35-
This section outlines the workflow to create and update IPsec/IKE policy on a S2S VPN or VNet-to-VNet connection:
20+
The instructions in this article help you set up and configure IPsec/IKE policies as shown in the following diagram.
21+
22+
:::image type="content" source="./media/ipsec-ike-policy-howto/policy-diagram.png" alt-text="Diagram shows IPsec/IKE policy." border="false" lightbox="./media/ipsec-ike-policy-howto/policy-diagram.png":::
3623

3724
1. Create a virtual network and a VPN gateway.
3825
1. Create a local network gateway for cross premises connection, or another virtual network and gateway for VNet-to-VNet connection.
3926
1. Create a connection (IPsec or VNet2VNet).
4027
1. Configure/update/remove the IPsec/IKE policy on the connection resources.
4128

42-
The instructions in this article help you set up and configure IPsec/IKE policies as shown in the diagram:
29+
## Policy parameters
4330

44-
:::image type="content" source="./media/ipsec-ike-policy-howto/policy-diagram.png" alt-text="Diagram shows IPsec/IKE policy." border="false" lightbox="./media/ipsec-ike-policy-howto/policy-diagram.png":::
45-
46-
## Supported cryptographic algorithms & key strengths
31+
[!INCLUDE [IPsec policy parameters](../../includes/vpn-gateway-ipsec-policy-parameters-include.md)]
4732

48-
### Algorithms and keys
33+
### Cryptographic algorithms & key strengths
4934

5035
The following table lists the supported configurable cryptographic algorithms and key strengths.
5136

5237
[!INCLUDE [Algorithm and keys table](../../includes/vpn-gateway-ipsec-ike-algorithm-include.md)]
5338

54-
#### Important requirements
55-
5639
[!INCLUDE [Important requirements table](../../includes/vpn-gateway-ipsec-ike-requirements-include.md)]
5740

58-
### Diffie-Hellman Groups
41+
### Diffie-Hellman groups
5942

60-
The following table lists the corresponding Diffie-Hellman Groups supported by the custom policy:
43+
The following table lists the corresponding Diffie-Hellman groups supported by the custom policy:
6144

62-
[!INCLUDE [Diffie-Hellman Groups](../../includes/vpn-gateway-ipsec-ike-diffie-hellman-include.md)]
45+
[!INCLUDE [Diffie-Hellman groups](../../includes/vpn-gateway-ipsec-ike-diffie-hellman-include.md)]
6346

6447
Refer to [RFC3526](https://tools.ietf.org/html/rfc3526) and [RFC5114](https://tools.ietf.org/html/rfc5114) for more details.
6548

@@ -71,60 +54,56 @@ This section walks you through the steps to create a Site-to-Site VPN connection
7154

7255
### Step 1 - Create the virtual network, VPN gateway, and local network gateway for TestVNet1
7356

74-
Create the following resources using the following values. For steps, see [Create a Site-to-Site VPN connection](./tutorial-site-to-site-portal.md).
75-
76-
**Virtual network** TestVNet1
77-
78-
* **Resource group:** TestRG1
79-
* **Name:** TestVNet1
80-
* **Region:** (US) East US
81-
* **IPv4 address space:** 10.1.0.0/16
82-
* **Subnet 1 name:** FrontEnd
83-
* **Subnet 1 address range:** 10.1.0.0/24
84-
* **Subnet 2 name:** BackEnd
85-
* **Subnet 2 address range:** 10.1.1.0/24
86-
87-
**VPN gateway:** VNet1GW
88-
89-
* **Name:** VNet1GW
90-
* **Region:** East US
91-
* **Gateway type:** VPN
92-
* **VPN type:** Route-based
93-
* **SKU:** VpnGw2
94-
* **Generation:** Generation 2
95-
* **Virtual network:** VNet1
96-
* **Gateway subnet address range:** 10.1.255.0/27
97-
* **Public IP address type:** Basic or Standard
98-
* **Public IP address:** Create new
99-
* **Public IP address name:** VNet1GWpip
100-
* **Enable active-active mode:** Disabled
101-
* **Configure BGP:** Disabled
57+
Create the following resources.For steps, see [Create a Site-to-Site VPN connection](./tutorial-site-to-site-portal.md).
58+
59+
1. Create the virtual network **TestVNet1** using the following values.
60+
61+
* **Resource group:** TestRG1
62+
* **Name:** TestVNet1
63+
* **Region:** (US) East US
64+
* **IPv4 address space:** 10.1.0.0/16
65+
* **Subnet 1 name:** FrontEnd
66+
* **Subnet 1 address range:** 10.1.0.0/24
67+
* **Subnet 2 name:** BackEnd
68+
* **Subnet 2 address range:** 10.1.1.0/24
69+
70+
1. Create the virtual network gateway **VNet1GW** using the following values.
71+
72+
* **Name:** VNet1GW
73+
* **Region:** East US
74+
* **Gateway type:** VPN
75+
* **VPN type:** Route-based
76+
* **SKU:** VpnGw2
77+
* **Generation:** Generation 2
78+
* **Virtual network:** VNet1
79+
* **Gateway subnet address range:** 10.1.255.0/27
80+
* **Public IP address type:** Basic or Standard
81+
* **Public IP address:** Create new
82+
* **Public IP address name:** VNet1GWpip
83+
* **Enable active-active mode:** Disabled
84+
* **Configure BGP:** Disabled
10285

10386
### Step 2 - Configure the local network gateway and connection resources
10487

105-
Create the local network gateway resource.
88+
1. Create the local network gateway resource **Site6** using the following values.
10689

107-
**Local network gateway** Site6
90+
* **Name:** Site6
91+
* **Resource Group:** TestRG1
92+
* **Location:** East US
93+
* **Local gateway IP address:** 5.4.3.2 (example value only - use the IP address of your on-premises device)
94+
* **Address Spaces** 10.61.0.0/16, 10.62.0.0/16 (example value only)
10895

109-
* **Name:** Site6
110-
* **Resource Group:** TestRG1
111-
* **Location:** East US
112-
* **Local gateway IP address:** 5.4.3.2 (example value only - use the IP address of your on-premises device)
113-
* **Address Spaces** 10.61.0.0/16, 10.62.0.0/16 (example value only)
96+
1. From the virtual network gateway, add a connection to the local network gateway using the following values.
11497

115-
**Connection:** VNet1 to Site6
116-
117-
From the virtual network gateway, add a connection to the local network gateway.
118-
119-
* **Connection name:** VNet1toSite6
120-
* **Connection type:** IPsec
121-
* **Local network gateway:** Site6
122-
* **Shared key:** abc123 (example value - must match the on-premises device key used)
123-
* **IKE protocol:** IKEv2
98+
* **Connection name:** VNet1toSite6
99+
* **Connection type:** IPsec
100+
* **Local network gateway:** Site6
101+
* **Shared key:** abc123 (example value - must match the on-premises device key used)
102+
* **IKE protocol:** IKEv2
124103

125104
### Step 3 - Configure a custom IPsec/IKE policy on the S2S VPN connection
126105

127-
In this section, configure a custom IPsec/IKE policy with the following algorithms and parameters:
106+
Configure a custom IPsec/IKE policy with the following algorithms and parameters:
128107

129108
* IKE Phase 1: AES256, SHA384, DHGroup24
130109
* IKE Phase 2(IPsec): AES256, SHA256, PFS None
@@ -144,12 +123,12 @@ In this section, configure a custom IPsec/IKE policy with the following algorith
144123

145124
1. Once all the options are selected, select **Save** to commit the changes to the connection resource. The policy will be enforced in about a minute.
146125

147-
> [!IMPORTANT]
148-
>
149-
> * Once an IPsec/IKE policy is specified on a connection, the Azure VPN gateway will only send or accept the IPsec/IKE proposal with specified cryptographic algorithms and key strengths on that particular connection. Make sure your on-premises VPN device for the connection uses or accepts the exact policy combination, otherwise the S2S VPN tunnel will not establish.
150-
>
151-
> * **Policy-based traffic selector** and **DPD timeout** options can be specified with **Default** policy, without the custom IPsec/IKE policy.
152-
>
126+
> [!IMPORTANT]
127+
>
128+
> * Once an IPsec/IKE policy is specified on a connection, the Azure VPN gateway will only send or accept the IPsec/IKE proposal with specified cryptographic algorithms and key strengths on that particular connection. Make sure your on-premises VPN device for the connection uses or accepts the exact policy combination, otherwise the S2S VPN tunnel will not establish.
129+
>
130+
> * **Policy-based traffic selector** and **DPD timeout** options can be specified with **Default** policy, without the custom IPsec/IKE policy.
131+
>
153132
154133
## Create VNet-to-VNet connection with custom policy
155134

0 commit comments

Comments
 (0)