Azure Network Virtual Appliances

Integrating VPN Devices with Azure Virtual Network

This document provides guidance on integrating your on-premises VPN devices with Azure Virtual Network (VNet). This enables secure, hybrid connectivity between your organization's network and Azure resources.

Overview of VPN Devices in Azure

Azure supports a wide range of third-party VPN devices that are compatible with its VPN Gateway service. These devices act as the gateway from your local network to Azure over an IPsec/IKE VPN tunnel.

Key Concepts:

• VPN Gateway: A managed service in Azure that enables you to create and manage VPN connections.
• Site-to-Site (S2S) VPN: A connection between your on-premises network and Azure VNet.
• IPsec/IKE: The standard protocols used to establish secure VPN tunnels.
• Shared Key: A pre-shared key (PSK) used for authentication between the VPN devices.

Supported VPN Devices

Azure works closely with leading network vendors to ensure compatibility. While Azure VPN Gateway itself is a managed service, the on-premises side requires a compatible VPN device. You can find a list of tested and validated VPN devices from our partners:

Vendor	Model Series	Key Features	Resources
Cisco	ASA, ISR	Robust security, high performance	Cisco Integration Guide
Palo Alto Networks	VM-Series, PA-Series	Next-generation firewall capabilities	Palo Alto Networks Guide
Fortinet	FortiGate	Unified threat management	Fortinet Configuration Steps
Check Point	Quantum, CloudGuard	Advanced threat prevention	Check Point Deployment Notes
Juniper Networks	SRX Series	Scalable and secure routing	Juniper Networks Solution Brief

For a comprehensive and up-to-date list, please refer to the Azure VPN Device Catalog.

Configuration Steps

The general process for integrating a VPN device involves configuring both Azure VPN Gateway and your on-premises VPN device. While specific steps vary by vendor, the core principles remain the same:

1. Create an Azure VPN Gateway: Provision a VPN Gateway in your Azure VNet.
2. Create a Local Network Gateway: Define the IP address range and public IP address of your on-premises network.
3. Create a Connection: Establish a connection resource in Azure, linking the VPN Gateway to the Local Network Gateway. This involves specifying the IPsec/IKE parameters and the shared key.
4. Configure your On-Premises VPN Device: Configure your physical or virtual VPN device to establish an IPsec tunnel to the public IP address of your Azure VPN Gateway. This includes matching the IPsec/IKE parameters (encryption, hashing, lifetimes, Diffie-Hellman groups) and entering the shared key.
5. Verify Connectivity: Once configured, test the tunnel status in both Azure and your VPN device, and verify network reachability to your Azure resources.

Best Practices for VPN Device Integration

• Use Strong Shared Keys: Employ complex and unique shared keys for enhanced security.
• Match IPsec/IKE Parameters: Precisely match all IPsec/IKE phase 1 and phase 2 parameters between your VPN device and Azure VPN Gateway. Refer to the vendor-specific guides.
• Monitor Tunnel Status: Regularly monitor the status of your VPN tunnels to ensure continuous connectivity.
• Plan for High Availability: Consider deploying active-standby or active-active configurations for your VPN Gateway and on-premises devices for increased resilience.
• Leverage Azure Network Watcher: Use Azure Network Watcher tools to diagnose connectivity issues.

Troubleshooting Common Issues

If you encounter connectivity problems, consider the following:

• Incorrect Shared Key: The most common cause of tunnel establishment failure.
• Mismatched IPsec/IKE Parameters: Ensure all settings are identical on both ends.
• Firewall Blocking: Verify that no firewalls are blocking the necessary IPsec traffic.
• Routing Issues: Confirm that appropriate routes are in place on both your on-premises network and Azure VNet.

For detailed troubleshooting steps, consult the Azure VPN Gateway troubleshooting documentation.

Next Steps

Once your VPN device is successfully integrated, you can explore further networking scenarios such as:

• Connecting multiple VNets using VNet-to-VNet VPNs.
• Implementing Azure Firewall for advanced network security.
• Configuring ExpressRoute for dedicated private connections.