I'm trying to connect an Azure network to an on-site VPN via a site to site connection. I don't have control or much knowledge of the on-site network.
On the Azure side, I have a Virtual Network Gateway set up. There is 1 windows vm on the Azure side that needs to be in the on-site network.
So I just want to get a check on my conceptual understanding of these things.
There are a few things I'm not sure about. First, there's a request for the NAT IP address. I understand Azure used SNAT.. does this mean there is no applicable NAT IP Address?
Another question has to do with timers. there is an entry for IKE Phase 1 and IPSec Phase 2 times. There does not seem to be an option in Azure to set these times except for SALifetime. Are these related?
Another question is: the server that needs to access the other site--should I put it in the same subnet as the Virtual Network Gateway?
And just to double-check my process:
In Azure, once I create the Virtual Network Gateway and hook it up to a subnet, I create a Local Gateway with the onsite information. I will then create a policy with a command along these lines:
$ipsecpolicy6 = New-AzureRmIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA384 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA256 -PfsGroup None -SALifeTimeSeconds 14400 -SADataSizeKilobytes 102400000
And then I will create an actual connection along these lines:
$vnet1gw = Get-AzureRmVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1 $lng6 = Get-AzureRmLocalNetworkGateway -Name $LNGName6 -ResourceGroupName $RG1 New-AzureRmVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng6 -Location $Location1 -ConnectionType IPsec -IpsecPolicies $ipsecpolicy6 -SharedKey 'AzureA1b2C3'
Obviously plugging in appropriate info for the variables.
Any answers, clarifications or tips would be appreciated.