You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: includes/vpn-gateway-faq-ipsecikepolicy-include.md
+19-56Lines changed: 19 additions & 56 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: include file
3
3
author: cherylmc
4
4
ms.service: vpn-gateway
5
-
ms.date: 05/25/2022
5
+
ms.date: 01/30/2023
6
6
ms.author: cherylmc
7
7
---
8
8
### Is Custom IPsec/IKE policy supported on all Azure VPN Gateway SKUs?
@@ -19,72 +19,29 @@ No, you must specify all algorithms and parameters for both IKE (Main Mode) and
19
19
20
20
### What are the algorithms and key strengths supported in the custom policy?
21
21
22
-
The following table lists the supported cryptographic algorithms and key strengths configurable by the customers. You must select one option for every field.
> * DHGroup2048 & PFS2048 are the same as Diffie-Hellman Group **14** in IKE and IPsec PFS. See [Diffie-Hellman Groups](#DH) for the complete mappings.
38
-
> * For GCMAES algorithms, you must specify the same GCMAES algorithm and key length for both IPsec Encryption and Integrity.
39
-
> * IKEv2 Main Mode SA lifetime is fixed at 28,800 seconds on the Azure VPN gateways.
40
-
> * QM SA Lifetimes are optional parameters. If none was specified, default values of 27,000 seconds (7.5 hrs) and 102400000 KBytes (102GB) are used.
41
-
> * UsePolicyBasedTrafficSelector is an option parameter on the connection. See the next FAQ item for "UsePolicyBasedTrafficSelectors".
42
-
43
-
### Does everything need to match between the Azure VPN gateway policy and my on-premises VPN device configurations?
44
-
45
-
Your on-premises VPN device configuration must match or contain the following algorithms and parameters that you specify on the Azure IPsec/IKE policy:
46
-
47
-
* IKE encryption algorithm
48
-
* IKE integrity algorithm
49
-
* DH Group
50
-
* IPsec encryption algorithm
51
-
* IPsec integrity algorithm
52
-
* PFS Group
53
-
* Traffic Selector (*)
54
-
55
-
The SA lifetimes are local specifications only, don't need to match.
56
-
57
-
If you enable **UsePolicyBasedTrafficSelectors**, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any. For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
58
-
* 10.1.0.0/16 <====> 192.168.0.0/16
59
-
* 10.1.0.0/16 <====> 172.16.0.0/16
60
-
* 10.2.0.0/16 <====> 192.168.0.0/16
61
-
* 10.2.0.0/16 <====> 172.16.0.0/16
22
+
The following table lists the supported cryptographic algorithms and key strengths that you can configure. You must select one option for every field.
23
+
24
+
[!INCLUDE [Algorithm and keys table](vpn-gateway-ipsec-ike-algorithm-include.md)]
For more information, see [Connect multiple on-premises policy-based VPN devices](../articles/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps.md).
64
29
65
30
### <aname ="DH"></a>Which Diffie-Hellman Groups are supported?
66
31
67
-
The table below lists the supported Diffie-Hellman Groups for IKE (DHGroup) and IPsec (PFSGroup):
32
+
The following table lists the corresponding Diffie-Hellman groups supported by the custom policy:
For more information, see [RFC3526](https://tools.ietf.org/html/rfc3526) and [RFC5114](https://tools.ietf.org/html/rfc5114).
36
+
Refer to [RFC3526](https://tools.ietf.org/html/rfc3526) and [RFC5114](https://tools.ietf.org/html/rfc5114) for more details.
80
37
81
38
### Does the custom policy replace the default IPsec/IKE policy sets for Azure VPN gateways?
82
39
83
40
Yes, once a custom policy is specified on a connection, Azure VPN gateway will only use the policy on the connection, both as IKE initiator and IKE responder.
84
41
85
42
### If I remove a custom IPsec/IKE policy, does the connection become unprotected?
86
43
87
-
No, the connection will still be protected by IPsec/IKE. Once you remove the custom policy from a connection, the Azure VPN gateway reverts back to the [default list of IPsec/IKE proposals](../articles/vpn-gateway/vpn-gateway-about-vpn-devices.md) and restart the IKE handshake again with your on-premises VPN device.
44
+
No, the connection will still be protected by IPsec/IKE. Once you remove the custom policy from a connection, the Azure VPN gateway reverts back to the [default list of IPsec/IKE proposals](../articles/vpn-gateway/vpn-gateway-about-vpn-devices.md#RouteBasedOffers) and restart the IKE handshake again with your on-premises VPN device.
88
45
89
46
### Would adding or updating an IPsec/IKE policy disrupt my VPN connection?
90
47
@@ -104,7 +61,10 @@ Yes. A VNet-to-VNet tunnel consists of two connection resources in Azure, one fo
104
61
105
62
### What is the default DPD timeout value? Can I specify a different DPD timeout?
106
63
107
-
The default DPD timeout is 45 seconds. You can specify a different DPD timeout value on each IPsec or VNet-to-VNet connection between 9 seconds to 3600 seconds.
64
+
The default DPD timeout is 45 seconds. You can specify a different DPD timeout value on each IPsec or VNet-to-VNet connection, from 9 seconds to 3600 seconds.
65
+
66
+
> [!NOTE]
67
+
> The default value is 45 seconds on Azure VPN gateways. Setting the timeout to shorter periods will cause IKE to rekey more aggressively, causing the connection to appear to be disconnected in some instances. This may not be desirable if your on-premises locations are farther away from the Azure region where the VPN gateway resides, or when the physical link condition could incur packet loss. The general recommendation is to set the timeout between **30 and 45** seconds.
108
68
109
69
### Does custom IPsec/IKE policy work on ExpressRoute connection?
110
70
@@ -131,6 +91,9 @@ If your static routing or route based IKEv1 connection is disconnecting at routi
131
91
132
92
If your connection is reconnecting at random times, follow our [troubleshooting guide](../articles/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-disconnected-intermittently.md).
133
93
134
-
### Where can I find more configuration information for IPsec?
94
+
### Where can I find configuration information and steps?
95
+
96
+
See the following articles for more information and configuration steps.
135
97
136
-
See [Configure IPsec/IKE policy for S2S or VNet-to-VNet connections](../articles/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell.md).
98
+
*[Configure IPsec/IKE policy for S2S or VNet-to-VNet connections - Azure portal](../articles/vpn-gateway/ipsec-ike-policy-howto.md)
99
+
*[Configure IPsec/IKE policy for S2S or VNet-to-VNet connections - Azure PowerShell](../articles/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell.md)
Copy file name to clipboardExpand all lines: includes/vpn-gateway-ipsec-ike-requirements-include.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -28,9 +28,9 @@ ms.topic: include
28
28
29
29
* IKE Main Mode SA lifetime is fixed at 28,800 seconds on the Azure VPN gateways.
30
30
31
-
* If you set **UsePolicyBasedTrafficSelectors** to $True on a connection, it will configure the Azure VPN gateway to connect to policy-based VPN firewall on premises. If you enable PolicyBasedTrafficSelectors, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any.
31
+
*'UsePolicyBasedTrafficSelectors' is an optional parameter on the connection. If you set **UsePolicyBasedTrafficSelectors** to $True on a connection, it will configure the Azure VPN gateway to connect to policy-based VPN firewall on premises. If you enable PolicyBasedTrafficSelectors, you need to ensure your VPN device has the matching traffic selectors defined with all combinations of your on-premises network (local network gateway) prefixes to/from the Azure virtual network prefixes, instead of any-to-any.
32
32
33
-
For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
33
+
For example, if your on-premises network prefixes are 10.1.0.0/16 and 10.2.0.0/16, and your virtual network prefixes are 192.168.0.0/16 and 172.16.0.0/16, you need to specify the following traffic selectors:
0 commit comments