Azure VNet-to-VNet connection

In this new post I’m going to configure a VNet-to-VNet connection (Site-to-Site), to provide VPN access between two Azure Virtual Networks.

Connecting a virtual network to another virtual network (VNet-to-VNet) is very similar to connecting a virtual network to an on-premises site location, as in both cases you will use a VPN gateway to provide secure tunnel using IPsec/IKE. Therefore, even though I’m connecting two Virtual Networks (VNet1 and VNet2), I’ll treat opposite Virtual Networks as On-premises networks (I.e. VNet1 will see VNet2 as an on-premises network, and vice versa).

VNet2VNet_000_PP

As you can see in the above figure, I am using network 192.168.10.0 for VNet1 and network 172.16.0.0 for VNet2.

So I will start the lab by registering two DNS servers (one for each Virtual Network). To do this click on the NEW button on the bottom left corner of your Azure portal (Classic portal), click on NETWOKR SERVICES, VIRTUAL NETWORK, and REGISTER DNS SERVER.

VNet2VNet_00

You can enter the NAME, DNS SERVER IP ADDRESS and select the Azure subscription you want to use. (Note that you can use different subscriptions for each DNS server, as you can connect two Virtual networks from different subscriptions and/or different regions). Then click on REGISTER DNS SERVER. In my case I named the DNS server for VNet1 as VNet1DNS with an IP 192.168.10.4 and for VNet2 as VNet2DNS with an IP 172.16.0.4. Note that I am using the forth IP for each DNS server, that is because Azure the first three addresses are reserved in Azure for internal use, therefore for the first Virtual Machine you create in the Network the default address assigned to it will be the forth address (192.168.10.4 in case of VNet1) which will match with the DNS server we created (this first VM I usually set it to be a Domain Controller).

Next, we need to create the Virtual Networks. Again click on the NEW button on the bottom left corner of your Azure portal, click on NETWOKR SERVICES, VIRTUAL NETWORK, and CUSTOM CREATE. The CREATE A VIRTUAL NETWORK windows will open.

VNet2VNet_001

On the Virtual Network Details page write the NAME of the Virtual Network, the LOCATION and select the Azure SUBSCRIPTION you want to use (same subscription you used for the DNS server VNet1DNS). Continue to the next page by clicking on the arrow on the lower left.

VNet2VNet_01

On the DNS Server and VPN Connectivity page, select the DNS server we registered previously (VNet1DNS). You do not need select the checkboxes for Point-to-Site or Site-to-Site connectivity. Continue to the next page.

VNet2VNet_02

On the Virtual Network Address Spaces page, write the STARTING IP address (192.168.10.0 for VNet1) and select the CIDR (ADDRESS COUNT) prefix (I selected /24 for VNet1). I also changed the CIDR prefix for the Subnet-1 to /25. Click the checkmark to finish.

VNet2VNet_03

With the first Virtual network created we can repeat the same steps to create a second Virtual Network (VNet2). Write NAME, select the LOCATION and SUBSCRIPTION and continue to the next page.

VNet2VNet_04

Select the DNS we registered previously (VNet2DNS) and continue to next page.

VNet2VNet_05

Write the IP address for VNet2, 172.16.0.0/16 and for Subnet-1 172.16.0.0/24. Click the checkmark when done.

VNet2VNet_06

The next step is to create Local Networks Sites. Azure will use the settings that you specify in the local network site to determine how to route traffic between the Virtual Networks. As I mentioned before I will treat opposite networks as on-premises networks (VNet1 will see VNet2 as an on-premises network and vice versa), therefore the local network connected to VNet1 I’ll call it OnPremVNet2, and local network connected to VNet2 I’ll call it OpPremVNet1.

Once again click on the NEW button on the bottom left corner of your Azure portal, click on NETWOKR SERVICES, VIRTUAL NETWORK, and ADD LOCAL NETWORK. The ADD LOCAL NETWORK windows will open.

VNet2VNet_007

On the Specify your local network details page, write the NAME (OnPremVNet2). Then write a temporary VPN DEVICE IP ADDRESS, note that here we need to add the public IP address assigned to the gateway for of our Virtual Network, however as we haven’t created the gateway yet we can just use a temporary IP address, we cannot leave the IP in blank. Then select the Azure Subscription and continue to the next page.

VNet2VNet_07

On Specify the address space page, write the same network you used for VNet2 (172.16.0.0/16), then click the checkmark to create the local network.

VNet2VNet_08

Repeat the same steps to create the local network that will be connected to VNet2. Write the NAME (OnPremVNet1), temporary VPN DEVICE IP ADDRESS, and subscription. Then continue to the next page

VNet2VNet_09

On the next page, specify the IP network used for VNet1 (192.168.10.0/24) and click the checkmark to finish. You can verify the creation of the local networks on the Azure portal, navigate to NETWORKS and click on the LOCAL NETWORKS tab.

VNet2VNet_10

With both local networks created, we now need to configure our Virtual Networks adding the local network to each. In your Azure portal, navigate to NETWORKS and on the VIRTUAL NETWORKS tab select VNet1. On VNet1, select CONFIGURE tab.

VNet2VNet_11

On the VNet1 configuration page, under site-to-site connectivity click on the Connect to the local network checkbox, and select the local network to which VNet1 will be connecting (OnPremVNet2). You will also notice that a new gateway was created in our virtual network address spaces. Save the changes.

VNet2VNet_12

Let’s repeat the same steps for VNet2. Navigate to VNet2 CONFIGURATION page, under site-to-site connectivity click on the Connect to the local network checkbox, select the local network to which VNet2 will be connecting (OnPremVNet1) and save the changes.

VNet2VNet_14

Navigate to the DASHBOARD of your Virtual Networks (VNet1 and VNet2). There you will notice that the Gateways were not really created.

VNet2VNet_15

To create the gateway, click on CREATE GATEWAY on the bar at the bottom center, and select Dynamic Routing. Note that Static Routing is not supported, so if you are using a virtual network previously created with static routing you will need to delete the gateway and create a dynamic gateway.

VNet2VNet_17

The creation of the Gateways will start. Repeat the same steps for the other VNet. (Do not worry if it is taking long, it took about 30min or more for the gateways to be created).

VNet2VNet_19

VNet2VNet_18

When the gateways get created, navigate to the DASHBOARD of each VNet and take note of the public IP assigned to each Gateway.

VNet2VNet_20

VNet2VNet_21

Next we need to replace the temporary IP addresses we assigned to the local networks with the gateway IP addresses. On the Azure portal navigate to NETWORKS and select the LOCAL NETWORKS tab, select the OnPremVNet1 and click on EDIT on the bar at the bottom of the page. On the VPN DEVICE IP ADDRESS of OnPremVNet1 write the Public IP address assigned to the Gateway of VNet1, continue to the next page, and click the checkmark to finish.

VNet2VNet_22

Repeat the same with the OnPremVNet2, there write the public IP address assigned to VNet2 gateway, continue to the next page, and click the checkmark to finish.

VNet2VNet_23

Back to the DASHBOARD of each VNet you will now notice that the Virtual Networks still unable to connect. This is because now we need to set the IPsec IKE pre-shared key to create the VPN connection. To create the Pre-shared key on the DASHBOARD of VNet1 or VNet2 (any of them will work), and click on MANAGE KEY on the bar at the bottom.

VNet2VNet_25

On the Manage Share Key page copy the key to your notepad and click on the checkmark.

VNet2VNet_26

To set the Pre-Shared key to both VNets and create the connection between Virtual Networks we need to use PowerShell as this steps cannot be done through the portal. Therefore open PowerShell as Administrator and connect to your Azure account.

Add-AzureAccount

Make sure you select the subscription you used for each VNet when following the next steps. You can review the steps for signing in and select Azure subscription in this post.

Then, let us create the connecting between VNet1 and OnPremVNet2. (Note the shared key XXXYYYYZZZZZAAAAA, is the key you copied on your notepad).

Set-AzureVNetGatewayKey -VNetName VNet1 -LocalNetworkSiteName OnPremVNet2 -SharedKey XXXYYYYZZZZZAAAAA

Then the connection between VNet2 and OnPremVNet1. (Using the same key)

Set-AzureVNetGatewayKey -VNetName VNet2 -LocalNetworkSiteName OnPremVNet1 -SharedKey XXXYYYYZZZZZAAAAA

VNet2VNet_27

After the VPN connection is created the DASHBOARD for each VNet will look as follow:

VNet2VNet_28

VNet2VNet_29

Congratulations!! You just set your VNet-to-VNet connection.

To test connectivity between VNets, I created a Virtual Machine in each Virtual Network VNet1VM on VNet1 and VNet2VM on VNet2 (as showed in the figures above).

Connect to your VMs, ad check the IP configuration of each.

VNet2VNet_36

VNet2VNet_37

For the Ping test to be successful we need to enable ICMP Echo messages on both Virtual Machines.

VNet2VNet_38

Finally use PowerShell to test connectivity by pinging the Virtual Machine on the other network.

VNet2VNet_39

VNet2VNet_40

Advertisements

One thought on “Azure VNet-to-VNet connection

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s