You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: 'Connect your on-premises network to an Azure VNet: site-to-site VPN: PowerShell'
3
-
description: Learn how to create a site-to-site VPN Gateway connection between your on-premises network and an Azure VNet using PowerShell.
2
+
title: 'Connect your on-premises network to an Azure virtual network: site-to-site VPN: PowerShell'
3
+
description: Learn how to create a site-to-site VPN Gateway connection between your on-premises network and an Azure virtual network using PowerShell.
4
4
titleSuffix: Azure VPN Gateway
5
5
author: cherylmc
6
6
ms.service: azure-vpn-gateway
@@ -10,191 +10,68 @@ ms.author: cherylmc
10
10
ms.custom: devx-track-azurepowershell
11
11
12
12
---
13
-
# Create a VNet with a site-to-site VPN connection using PowerShell
13
+
# Create a site-to-site VPN connection using PowerShell
14
14
15
-
This article shows you how to use PowerShell to create a site-to-site VPN gateway connection from your on-premises network to the VNet. The steps in this article apply to the [Resource Manager deployment model](../azure-resource-manager/management/deployment-models.md). You can also create this configuration using a different deployment tool or deployment model by selecting a different option from the following list:
This article shows you how to use PowerShell to create a site-to-site VPN gateway connection from your on-premises network to a virtual network (VNet). The steps in this article apply to the [Resource Manager deployment model](../azure-resource-manager/management/deployment-models.md).
22
16
23
17
A site-to-site VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device located on-premises that has an externally facing public IP address assigned to it. For more information about VPN gateways, see [About VPN gateway](vpn-gateway-about-vpngateways.md).
Verify that you have met the following criteria before beginning your configuration:
23
+
Verify that your environment meets the following criteria before beginning your configuration:
30
24
25
+
* Verify that you have a functioning route-based VPN gateway. To create a VPN gateway, see [Create a VPN gateway](create-gateway-powershell.md).
31
26
* Make sure you have a compatible VPN device and someone who is able to configure it. For more information about compatible VPN devices and device configuration, see [About VPN Devices](vpn-gateway-about-vpn-devices.md).
32
27
* Verify that you have an externally facing public IPv4 address for your VPN device.
33
-
* If you're unfamiliar with the IP address ranges located in your on-premises network configuration, you need to coordinate with someone who can provide those details for you. When you create this configuration, you must specify the IP address range prefixes that Azure will route to your on-premises location. None of the subnets of your on-premises network can over lap with the virtual network subnets that you want to connect to.
28
+
* If you're unfamiliar with the IP address ranges located in your on-premises network configuration, you need to coordinate with someone who can provide those details for you. When you create this configuration, you must specify the IP address range prefixes that Azure routes to your on-premises location. None of the subnets of your on-premises network can over lap with the virtual network subnets that you want to connect to.
The examples in this article use the following values. You can use these values to create a test environment, or refer to them to better understand the examples in this article.
42
-
43
-
```
44
-
#Example values
45
-
46
-
VnetName = VNet1
47
-
ResourceGroup = TestRG1
48
-
Location = East US
49
-
AddressSpace = 10.1.0.0/16
50
-
SubnetName = Frontend
51
-
Subnet = 10.1.0.0/24
52
-
GatewaySubnet = 10.1.255.0/27
53
-
LocalNetworkGatewayName = Site1
54
-
LNG Public IP = <On-premises VPN device IP address>
55
-
Local Address Prefixes = 10.0.0.0/24, 20.0.0.0/24
56
-
Gateway Name = VNet1GW
57
-
PublicIP = VNet1GWPIP
58
-
Gateway IP Config = gwipconfig1
59
-
VPNType = RouteBased
60
-
GatewayType = Vpn
61
-
ConnectionName = VNet1toSite1
62
-
```
63
-
64
-
## <aname="VNet"></a>1. Create a virtual network and a gateway subnet
65
-
66
-
If you don't already have a virtual network, create one. When creating a virtual network, make sure that the address spaces you specify don't overlap any of the address spaces that you have on your on-premises network.
67
-
68
-
> [!NOTE]
69
-
> In order for this VNet to connect to an on-premises location, you need to coordinate with your on-premises network administrator to carve out an IP address range that you can use specifically for this virtual network. If a duplicate address range exists on both sides of the VPN connection, traffic does not route the way you might expect it to. Additionally, if you want to connect this VNet to another VNet, the address space cannot overlap with other VNet. Take care to plan your network configuration accordingly.
### <aname="vnet"></a>Create a virtual network and a gateway subnet
78
-
79
-
This example creates a virtual network and a gateway subnet. If you already have a virtual network that you need to add a gateway subnet to, see [To add a gateway subnet to a virtual network you have already created](#gatewaysubnet).
## <aname="localnet"></a>Create a local network gateway
124
35
125
-
## 2. <aname="localnet"></a>Create the local network gateway
126
-
127
-
The local network gateway (LNG) typically refers to your on-premises location. It isn't the same as a virtual network gateway. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you will create a connection. You also specify the IP address prefixes that will be routed through the VPN gateway to the VPN device. The address prefixes you specify are the prefixes located on your on-premises network. If your on-premises network changes, you can easily update the prefixes.
36
+
The local network gateway (LNG) typically refers to your on-premises location. It isn't the same as a virtual network gateway. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you'll create a connection. You also specify the IP address prefixes that are routed through the VPN gateway to the VPN device. The address prefixes you specify are the prefixes located on your on-premises network. If your on-premises network changes, you can easily update the prefixes.
128
37
129
38
Select one of the following examples. The values used in the examples are:
130
39
131
-
* The *GatewayIPAddress* is the IP address of your on-premises VPN device.
40
+
* The *GatewayIPAddress* is the IP address of your on-premises VPN device, not your Azure VPN gateway.
132
41
* The *AddressPrefix* is your on-premises address space.
-Location 'East US' -GatewayIpAddress '[IP address of your on-premises VPN device]' -AddressPrefix @('192.168.0.0/24','10.0.0.0/24')
146
55
```
147
56
148
-
## <aname="PublicIP"></a>3. Request a public IP address
149
-
150
-
A VPN gateway must have a public IP address. You first request the IP address resource, and then refer to it when creating your virtual network gateway. The IP address is dynamically assigned to the resource when the VPN gateway is created. The only time the public IP address changes is when the gateway is deleted and re-created. It doesn't change across resizing, resetting, or other internal maintenance/upgrades of your VPN gateway.
151
-
152
-
Request a public IP address for your virtual network VPN gateway.
## <aname="GatewayIPConfig"></a>4. Create the gateway IP addressing configuration
159
-
160
-
The gateway configuration defines the subnet (the 'GatewaySubnet') and the public IP address to use. Use the following example to create your gateway configuration:
## <aname="CreateGateway"></a>5. Create the VPN gateway
169
-
170
-
Create the virtual network VPN gateway. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. The following values are used in the example:
171
-
172
-
* The *-GatewayType* for a site-to-site configuration is *Vpn*. The gateway type is always specific to the configuration that you're implementing. For example, other gateway configurations might require -GatewayType ExpressRoute.
173
-
* The *-VpnType* can be *RouteBased* (referred to as a Dynamic Gateway in some documentation), or *PolicyBased* (referred to as a Static Gateway in some documentation). For more information about VPN gateway types, see [About VPN Gateway](vpn-gateway-about-vpngateways.md).
174
-
* Select the Gateway SKU that you want to use. There are configuration limitations for certain SKUs. For more information, see [Gateway SKUs](vpn-gateway-about-vpn-gateway-settings.md#gwsku). If you get an error when creating the VPN gateway regarding the -GatewaySku, verify that you have installed the latest version of the PowerShell cmdlets.
## <aname="ConfigureVPNDevice"></a>6. Configure your VPN device
57
+
## <aname="ConfigureVPNDevice"></a>Configure your VPN device
183
58
184
59
Site-to-site connections to an on-premises network require a VPN device. In this step, you configure your VPN device. When configuring your VPN device, you need the following items:
185
60
186
-
* A shared key. This is the same shared key that you specify when creating your site-to-site VPN connection. In our examples, we use a basic shared key. We recommend that you generate a more complex key to use.
187
-
* The public IP address of your virtual network gateway. You can view the public IP address by using the Azure portal, PowerShell, or CLI. To find the public IP address of your virtual network gateway using PowerShell, use the following example. In this example, VNet1GWPIP is the name of the public IP address resource that you created in an earlier step.
61
+
* A shared key. You'll use this shared key both when you configure your VPN device, and when you create your site-to-site VPN connection. In our examples, we use a basic shared key. We recommend that you generate a more complex key to use. The important thing is that the key is the same on both sides of the connection.
62
+
* The public IP address of your virtual network gateway. You can view the public IP address by using the Azure portal, PowerShell, or CLI. To find the public IP address of your virtual network gateway using PowerShell, use the following example. In this example, VNet1GWpip1 is the name of the public IP address resource that you created in an earlier step.
## <aname="CreateConnection"></a>7. Create the VPN connection
70
+
## <aname="CreateConnection"></a>Create the VPN connection
196
71
197
-
Next, create the site-to-site VPN connection between your virtual network gateway and your VPN device. Be sure to replace the values with your own. The shared key must match the value you used for your VPN device configuration. Notice that the '-ConnectionType' for site-to-site is **IPsec**.
72
+
Create a site-to-site VPN connection between your virtual network gateway and your on-premises VPN device. If you're using an active-active mode gateway (recommended), each gateway VM instance has a separate IP address. To properly configure [highly available connectivity](vpn-gateway-highlyavailable.md), you must establish a tunnel between each VM instance and your VPN device. Both tunnels are part of the same connection.
73
+
74
+
Be sure to replace the values in the examples with your own. The shared key must match the value you used for your VPN device configuration. Notice that the '-ConnectionType' for site-to-site is **IPsec**.
198
75
199
76
1. Set the variables.
200
77
@@ -211,18 +88,12 @@ Next, create the site-to-site VPN connection between your virtual network gatewa
211
88
-ConnectionType IPsec -SharedKey 'abc123'
212
89
```
213
90
214
-
After a short while, the connection will be established.
215
-
216
-
## <aname="toverify"></a>8. Verify the VPN connection
91
+
## <aname="toverify"></a>Verify the VPN connection
217
92
218
93
There are a few different ways to verify your VPN connection.
## <aname="connectVM"></a>To connect to a virtual machine
223
-
224
-
[!INCLUDE [Connect to a VM](../../includes/vpn-gateway-connect-vm.md)]
225
-
226
97
## <aname="modify"></a>To modify IP address prefixes for a local network gateway
227
98
228
99
If the IP address prefixes that you want routed to your on-premises location change, you can modify the local network gateway. When using these examples, modify the values to match your environment.
0 commit comments