Hi all
Today I configured a VPN connection to Microsoft Azure. Maybe for some of you the snippets are useful...
The goal was to establish a route based VPN.
My device is an EdgeRouter Pro.
I tried two szenarios:
- "normal" IPSEC connection
- VPN connection with vti interface
My setup:
EdgeRouter:
- WAN Interface: 20.20.20.20 (eth7)
- LAN Interface: 192.168.20.1/24
Azure:
- Public IP Azure VPN Gateway: 30.30.30.30
- VNET in Azure: 192.168.30.0/24
Ubiquiti config snippet (only the VPN part) - "normal" IPSEC connection:
set vpn ipsec auto-firewall-nat-exclude disable set vpn ipsec disable-uniqreqids set vpn ipsec esp-group esp-azure compression disable set vpn ipsec esp-group esp-azure lifetime 3600 set vpn ipsec esp-group esp-azure mode tunnel set vpn ipsec esp-group esp-azure pfs disable set vpn ipsec esp-group esp-azure proposal 1 encryption aes256 set vpn ipsec esp-group esp-azure proposal 1 hash sha1 set vpn ipsec ike-group ike-azure ikev2-reauth no set vpn ipsec ike-group ike-azure key-exchange ikev2 set vpn ipsec ike-group ike-azure lifetime 28800 set vpn ipsec ike-group ike-azure proposal 1 dh-group 2 set vpn ipsec ike-group ike-azure proposal 1 encryption aes256 set vpn ipsec ike-group ike-azure proposal 1 hash sha1 set vpn ipsec ipsec-interfaces interface eth7 set vpn ipsec nat-traversal enable set vpn ipsec site-to-site peer 30.30.30.30 authentication mode pre-shared-secret set vpn ipsec site-to-site peer 30.30.30.30 authentication pre-shared-secret MYPRESHAREDKEY set vpn ipsec site-to-site peer 30.30.30.30 connection-type initiate set vpn ipsec site-to-site peer 30.30.30.30 default-esp-group esp-azure set vpn ipsec site-to-site peer 30.30.30.30 ike-group ike-azure set vpn ipsec site-to-site peer 30.30.30.30 ikev2-reauth inherit set vpn ipsec site-to-site peer 30.30.30.30 local-address 20.20.20.20 set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 allow-nat-networks disable set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 allow-public-networks disable set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 esp-group esp-azure set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 local prefix 192.168.20.0/24 set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 protocol all set vpn ipsec site-to-site peer 30.30.30.30 tunnel 100 remote prefix 192.168.30.0/24
VPN connection with vti interface:
set vpn ipsec auto-firewall-nat-exclude disable set vpn ipsec disable-uniqreqids set vpn ipsec esp-group esp-azure compression disable set vpn ipsec esp-group esp-azure lifetime 3600 set vpn ipsec esp-group esp-azure mode tunnel set vpn ipsec esp-group esp-azure pfs disable set vpn ipsec esp-group esp-azure proposal 1 encryption aes256 set vpn ipsec esp-group esp-azure proposal 1 hash sha1 set vpn ipsec ike-group ike-azure ikev2-reauth no set vpn ipsec ike-group ike-azure key-exchange ikev2 set vpn ipsec ike-group ike-azure lifetime 28800 set vpn ipsec ike-group ike-azure proposal 1 dh-group 2 set vpn ipsec ike-group ike-azure proposal 1 encryption aes256 set vpn ipsec ike-group ike-azure proposal 1 hash sha1 set vpn ipsec ipsec-interfaces interface eth7 set vpn ipsec nat-traversal enable set vpn ipsec site-to-site peer 30.30.30.30 authentication mode pre-shared-secret set vpn ipsec site-to-site peer 30.30.30.30 authentication pre-shared-secret MYPRESHAREDKEY set vpn ipsec site-to-site peer 30.30.30.30 connection-type initiate set vpn ipsec site-to-site peer 30.30.30.30 default-esp-group esp-azure set vpn ipsec site-to-site peer 30.30.30.30 ike-group ike-azure set vpn ipsec site-to-site peer 30.30.30.30 ikev2-reauth inherit set vpn ipsec site-to-site peer 30.30.30.30 local-address 20.20.20.20 set vpn ipsec site-to-site peer 30.30.30.30 vti bind vti100 set vpn ipsec site-to-site peer 30.30.30.30 vti esp-group esp-azure set interfaces vti vti100 address 169.254.0.1/24 set interfaces vti vti100 mtu 1436 set protocols static interface-route 192.168.30.0/24 next-hop-interface vti100
Both variants are working. Please keep in mind that I do not use NAT on this router. If you use NAT you have to exclude your local subnet.
Hopefully this helps someone!