Friday, April 10, 2015

Setup VNet-To-VNet VPN on Microsoft Azure - Part 1

To apply VNet to VNet communication on Microsoft Azure, we can configure Site-to-Site (S2S) VPN between VNets. The Site-to-Site VPN for VNets can be applied to following scenarios, requirements and considerations.

Cross region geo-redundancy and geo-presence
  • You can set up your own geo-replication or synchronization with secure connectivity without going over internet-facing endpoints.
  • With Azure Load Balancer and Microsoft or third party clustering technology, you can setup highly available workload with geo-redundancy across multiple Azure regions. One important example is to setup SQL Always On with Availability Groups spreading across multiple Azure regions.
Regional multi-tier applications with strong isolation boundary
  • Within the same region, you can setup multi-tier applications with multiple virtual networks connected together with strong isolation and secure inter-tier communication.
Cross subscription, inter-organization communication in Azure
  • If you have multiple Azure subscriptions, you can now connect workloads from different subscriptions together securely between virtual networks.
  • For enterprises or service providers, it is now possible to enable cross organization communication with secure VPN technology within Azure.

Requirements and considerations
  • VNet to VNet supports connecting Azure Virtual Networks. It does not support connecting virtual machines or cloud services NOT in a virtual network.
  • VNet to VNet requires Azure VPN gateways with dynamic routing VPNs - Azure static routing VPNs are not supported. Connecting multiple Azure virtual networks together does NOT require any on premises VPN gateways, unless cross premises connectivity is required.
  • Virtual network connectivity can be used simultaneously with multi-site VPNs, with a maximum of 10 VPN tunnels for a virtual network VPN gateway connecting to ether other virtual networks or on premises sites.
  • The address spaces of the virtual networks and on premises local network sites MUST NOT overlap. Overlapping address spaces will cause the creation of virtual networks or uploading netcfg configuration files to fail.
  • The virtual networks can be in the same or different subscriptions.
  • The virtual networks can be in the same or different Azure regions (locations).
  • Redundant tunnels between a pair of virtual networks are not supported.
  • A cloud service or a load balancing endpoint CANNOT span across virtual networks even though they are connected together.
  • All VPN tunnels of the virtual network, including P2S VPNs, share the available bandwidth on the Azure VPN gateway and the same VPN gateway uptime SLA in Azure.

Remark: We can perform "Resize-AzureVNetGateway" to increase maximum of 10 VPN tunnels to 30 VPN tunnels.

In this part, I'm going to create 2 VNets in different regions and then configure Site-to-Site VPN for these networks.

  • The configuration computer is installed Microsoft Azure PowerShell module
  • Create 2 VNets named euslabvnet and wuslabvnet in different regions
  • Create 2 local networks with the same names represent 2 virtual networks
  • Create 2 dynamic routing gateways on 2 VNets
  • Configure VPN shared key on 2 VPN gateways
Create virtual networks
First, we need to create 2 virtual networks on Microsoft Azure. One is located West US. Another is located East US. West US will be assigned address space and East US will be assigned  

1. Log in the Microsoft Azure Portal.
2. Select "Networks" tab.

3. Click "New > Virtual Network > Custom Create".

4. On "Virtual Network Details" window, next to "Name", enter "wuslabvnet".
5. Next to "Location", select "West US".

6. Click "Next".
7. For testing, we don't need to configure DNS server. Then, click "Next".

8. On "Virtual Network Address Spaces" window, the address space for wuslabvnet is

9. Click "OK".
10. Repeat step 3 - 9 to create euslabvnet in "EAST US" location  and assign address spaces for this VNet.

Create local networks
Then, we need to create 2 local networks to represent 2 virtual networks. Both local networks will be used the same name as the virtual networks. 

1. Select "Network" tab on "Microsoft Azure Portal".
2. Click "New > Virtual Network > Add Local Network".

3. On "Specify your local network details" window, next to "Name", enter "wuslabvnet".
4. Next to "VPN device IP address (optional)", enter "".

We haven't created a VPN gateway on both VNets but we need to enter a temp IP address under "VPN Device IP address" for creating local networks. After creating a gateway, we need to change it back to the real IP address.

5. Click "Next".
6. On "Specify the address space" window, enter wuslabvnet IP address space,".

7. Click "OK.
8. Repeat step 2 - 7 to create a local network euslabvnet and assign to be a temp gateway IP address. Then, enter under address space.

Assign local networks to virtual networks
To create a VPN gateway for the VNets, we need to assign the destination local network to the virtual network.  For example. euslabvnet local network should be mapped to wuslabvnet

1. Select "wuslabvnet" virtual network.
2. Select "Configure".

3. Next to "site-to-site connectivity" section, check "Connect to local network".
4. Next to "Local Network", select "euslabvnet".

The "Local Network" should be pointed to other site Address Spaces. In this lab environment, we select euslabvnet.

5. Next to "virtual network address spaces" section, make sure the "gateway subnet" is created. If not, click "add gateway subnet".

To create Site-to-Site VPN on Azure, the gateway subnet is compulsory.

6. Click "Save".
7. Repeat step 1 - 6 to configure euslabvnet virtual network.

Create dynamic routing gateways on VNets
Dynamic routing gateway is a key component for VNets communication. We're going to create dynamic routing gateway on both VNets and then update the public IP address of both gateways to the local networks. 

1. Select "wuslabvnet" virtual network.
2. Select "Dashboard".

3. Click "Create Gateway > Dynamic Routing" button to create the gateway.

Then, Azure will take 15 - 30 minutes to create the gateway.

4. Repeat step 1 - 3 to create "Gateway" on "euslabvnet".

5. We need to update the VPN gateway addresses on Local network.

Connect VPN gateways on both VNets
To make connections between both VNets, we need to set up a shared key. 

1. Launch "Microsoft Azure PowerShell".
2. Connect to your Azure subscription by performing "Add-AzureAccount".
3. Perform "Set-AzureVNetGatewayKey -VNetName wuslabvnet -LocalNetworkSiteName euslabvnet -SharedKey <shared key for VPN tunnel>" to setup VPN tunnel on wuslabvnet.

4.  Perform "Set-AzureVNetGatewayKey -VNetName euslabvnet -LocalNetworkSiteName wuslabvnet -SharedKey <shared key for VPN tunnel>" to setup VPN tunnel on euslabvnet.

Now, both VNets can communicate with each other.

Test result
I created 2 virtual machines on Microsoft Azure. One is under euslabvnet. The other is under wuslabvnet.

I performed "tracert" on both virtual machines to make sure it can communicate with each other.

In next part, I'm going to add 1 more VNet and configure VPN to communicate with wuslabvnet.

This posting is provided “AS IS” with no warranties, and confers no rights!


  1. Do you know how to make two vnets in the same subscription, same location, same resource group talk to each other in ARM (Azure Resource Manager)? I'm losing my mind over this.

    1. Hi,
      Sorry for my late reply.
      For ARM, you need to use Azure PowerShell to configure the VNet to VNet connection. Please read the following web site for your information.