0

I'm trying to connect an Azure network to an on-site VPN via a site to site connection. I don't have control or much knowledge of the on-site network.

On the Azure side, I have a Virtual Network Gateway set up. There is 1 windows vm on the Azure side that needs to be in the on-site network.

So I just want to get a check on my conceptual understanding of these things.

There are a few things I'm not sure about. First, there's a request for the NAT IP address. I understand Azure used SNAT.. does this mean there is no applicable NAT IP Address?

Another question has to do with timers. there is an entry for IKE Phase 1 and IPSec Phase 2 times. There does not seem to be an option in Azure to set these times except for SALifetime. Are these related?

Another question is: the server that needs to access the other site--should I put it in the same subnet as the Virtual Network Gateway?

And just to double-check my process:

In Azure, once I create the Virtual Network Gateway and hook it up to a subnet, I create a Local Gateway with the onsite information. I will then create a policy with a command along these lines: 

$ipsecpolicy6 = New-AzureRmIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA384 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA256 -PfsGroup None -SALifeTimeSeconds 14400 -SADataSizeKilobytes 102400000

And then I will create an actual connection along these lines:

$vnet1gw = Get-AzureRmVirtualNetworkGateway -Name $GWName1  -ResourceGroupName $RG1
$lng6 = Get-AzureRmLocalNetworkGateway  -Name $LNGName6 -ResourceGroupName $RG1

New-AzureRmVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng6 -Location $Location1 -ConnectionType IPsec -IpsecPolicies $ipsecpolicy6 -SharedKey 'AzureA1b2C3'

Obviously plugging in appropriate info for the variables.

Any answers, clarifications or tips would be appreciated.

Thanks

Improve this question
3
  • I am not sure what do you want to know in your first question. could you describe it?
    – Nancy
    Jul 20, 2018 at 5:38
  • @NancyXiong-MSFT --- so my question is on Azure is there an IP associated with the NAT device. Usually on a small network, the NAT would be the router, so the NAT address would be the router address, correct? My understanding is on Azure there is no dedicated NAT device with an IP under my control. Is that correct?
    – scl
    Jul 20, 2018 at 15:52
  • I am not sure the NAT address is the router address in Azure backend physical network since those are not under our control in Azure portal. We do not see the Azure physical Architecture. But surely there is a NAT for Azure VM resources.
    – Nancy
    Jul 21, 2018 at 3:34

1 Answer 1

Reset to default
0
  1. Really not sure what you are asking, you vm would talk to the internal network with its internal Azure IP, not external (using site-to-site that is)
  2. -SALifeTimeSeconds - The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds (source)
  3. No, you put it into another subnet in the same vnet (or in another if you peer them and allow transit).
Improve this answer
5
  • 1. The VM isn't talking to an Azure network, but an on-site network. So whose internal addressing would I use? The site network has a different address space. I can reconfigure if necessary.
    – scl
    Jul 20, 2018 at 15:55
  • you cannot have overlapping IP addresses for site-to-site to work, so they have to be different.
    – 4c74356b41
    Jul 20, 2018 at 16:00
  • OK, so to my understanding the NAT on a hardware network would usually be the router. If you had a windows server take over the routing/DHCP stuff, would/could you still use the router for its NAT? Maybe that's what they mean by NAT IP Address
    – scl
    Jul 20, 2018 at 16:03
  • Also, for 2: what would be the option in powershell for phase 1?
    – scl
    Jul 20, 2018 at 16:04
  • no option for phase 1, the docs clearly suggest that
    – 4c74356b41
    Jul 20, 2018 at 16:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .