Skip to main content

Tutorial: Connect Azure to CloudConnexa with IPsec

Abstract

Learn how to connect your Azure VNet to CloudConnexa with a site-to-site IPsec VPN tunnel, giving CloudConnexa users and networks secure access to Azure.

Overview

This tutorial shows how to connect your Microsoft Azure virtual network (VNet) to CloudConnexa using an IPsec site-to-site tunnel—without deploying a Connector virtual machine in your Azure environment.

Unlike a Connector-based deployment, IPsec uses Azure VPN Gateway to establish the connection. This means there is no Connector virtual machine to manage, but you need to configure the VPN on both the Azure side and in your CloudConnexa Administration portal.

Once configured, the site-to-site IPsec tunnels connect your Azure VNet to the selected CloudConnexa Region. Your CloudConnexa users—and any other networks connected through CloudConnexa—can then access resources in the VNet privately, without exposing them to the public internet.

Before you begin

Before configuring the IPsec connection, ensure you have the following:

  • A CloudConnexa account and Cloud ID.

  • Administrator access to your CloudConnexa Administration portal.

  • An Azure subscription.

  • An existing Azure VNet to connect to CloudConnexa.

  • Permissions to create subnets, local network gateways, virtual network gateways, public IP addresses, and VPN connections in Azure.

  • Available address space in the VNet for a subnet named GatewaySubnet.

Note

Creating an Azure virtual network gateway can take 45 minutes or longer, depending on the selected gateway SKU.

Tip

For Azure-specific prerequisites and current portal instructions, refer to the Microsoft documentation for creating a site-to-site VPN connection.

Step 1: Configure the Network Connector in CloudConnexa

  2. Navigate to Networks.

  3. Select Add Network.

  4. Select the appropriate Network Scenario.

  5. Configure the network details.

  6. When prompted, select IPsec for your tunneling protocol.

  7. On the Configure Network Connector page, select Azure from Platform to Connect.

    • CloudConnexa displays the values you need to configure the Azure gateways, tunnels, and VPN connection.

  8. Under Create Azure Gateways, review and copy the following values:

    • CloudConnexa Public IP Address: Select the available CloudConnexa public IP address from the list. You'll enter this value as the Azure local network gateway.

    • Address Spaces: These are the CloudConnexa-side networks that Azure routes through the IPsec tunnel.

    • BGP: Configure BGP as displayed. The current configuration requires BCP to be disabled.

  9. Also review the displayed virtual network gateway requirements:

    • Type: VPN

    • SKU: Any

    • Generation: Any

    • Public IP Address: New

    • Active-Active Mode: Enabled

    • BGP: Disabled

      Tip

      Keep the CloudConnexa page open while configuring Azure so you can copy the displayed values into the corresponding Azure fields.

  10. Under Set Up CloudConnexa Tunnel, review the fields, but don't enter the Azure gateway IP addresses yet. Azure assigns those addresses after creating the virtual network gateway.

  11. Leave Advanced Configuration unchanged unless the Azure VPN configuration requires different IPsec parameters.

  12. Open a new browser tab and sign in to the Azure portal.

Step 2: Create the Azure gateway subnet

Azure requires a dedicated subnet named GatewaySubnet for the virtual network gateway resources.

  1. In the Azure portal, navigate to the VNet you're connecting to CloudConnexa.

  2. Select Subnets.

  3. Select + Gateway subnet.

  4. Specify the subnet address range.

    Tip

    Microsoft recommends using a /27 or larger subnet, such as /26 or /25, to support the required gateway configuration.

  5. Select Save or Add, depending on the Azure portal interface.

    Important

    The subnet must be named GatewaySubnet. Do not deploy application resources or other virtual machines to this subnet.

Step 3: Create the Azure local network gateway

The local network gateway represents the CloudConnexa Region and the networks reachable through it.

  1. In the Azure portal, navigate to Local network gateways.

  2. Select + Create.

  3. On the Basics tab, configure the following settings:

    • Subscription: Select the appropriate Azure subscription.

    • Resource Group: Select the resource group for the VPN resources.

    • Region: Select the Azure region for the gateway resources.

    • Name: Enter a descriptive name, such as CloudConnexa.

    • Endpoint: Select IP address when prompted.

    • IP Address: Enter the CloudConnexa Public IP Address displayed in CloudConnexa.

    • Address Space: Add each IP range displayed under Address Spaces in CloudConnexa.

  4. Continue to the advanced configuration.

  5. Ensure Configure BGP settings is set to No or disabled.

  6. Select Review + create.

  7. After validation succeeds, select Create.

    Important

    Add every address space displayed in CloudConnexa. Missing ranges may prevent Azure from routing traffic to some CloudConnexa users or connected networks.

Step 4: Create the Azure virtual network gateway

The virtual network gateway provides the Azure-side VPN endpoints for the IPsec tunnels.

  1. In the Azure portal, search for and select Virtual network gateways.

  2. Select + Create.

  3. Configure the gateway:

    • Subscription: Select the appropriate subscription.

    • Name: Enter a name for the gateway.

    • Region: Select the region associated with the VNet.

    • Gateway Type: Select VPN.

    • SKU: Select an appropriate VPN gateway SKU.

    • Generation: Select a supported generation.

    • Virtual Network: Select the VNet containing the GatewaySubnet.

  4. Under the public IP address settings:

    • Create or select the first public IP address.

    • Enable Active-active mode.

    • Create or select the second public IP address.

  5. Ensure Configure BGP is disabled.

  6. Select Review + create.

  7. After validation succeeds, select Create.

    • Azure begins deploying the virtual network gateway.

      Note

      Gateway deployment can take 45 minutes or longer. You can monitor the deployment status from the gateway's Overview page.

  8. After deployment completes, locate the two public IP addresses assigned to the active-active virtual network gateway. You need these values to configure the CloudConnexa tunnels.

Step 5: Set up the CloudConnexa tunnels

  1. Return to the CloudConnexa Network Configuration Wizard.

  2. In Set Up CloudConnexa Tunnel, enter:

    • Connector Public IP Address: Enter the first public IP address assigned to the Azure virtual network gateway.

    • Pre-shared Key (PSK): Enter a strong pre-shared key.

  3. Configure tunnel 2 in the same manner.

  4. Record the pre-shared keys. You must enter the corresponding key when creating each Azure VPN connection.

  5. Leave the Advanced Configuration settings at their default values unless your environment requires different IPsec parameters.

Step 6: Create the first Azure VPN connection

Create a VPN connection between the Azure virtual network gateway and the CloudConnexa local network gateway.

  1. In the Azure portal, navigate to Connections.

  2. Select + Create.

  3. On the Basics tab, configure:

    • Subscription: Select the subscription containing the gateway resources.

    • Resource Group: Select the appropriate resource group.

    • Connection Type: Select Site-to-site (IPsec).

    • Name: Enter a name for the first connection.

    • Region: Select the same region as the gateway resources.

  4. Continue to the connection settings.

  5. Configure:

    • Virtual Network Gateway: Select the virtual network gateway created earlier.

    • Local Network Gateway: Select the Azure local network gateway created earlier.

    • Authentication type: Select Shared key.

    • Shared Key: Enter the pre-shared key configured for Tunnel 1 in CloudConnexa.

    • IKE Protocol: Select IKEv2.

    • Use Azure Private IP Address: Leave disabled.

    • Enable BGP: Leave disabled.

    • IPsec/IKE Policy: Select Custom.

    • Use Policy Based Traffic Selector: Select Enable.

  6. Configure the custom IPsec/IKE policy to match the values displayed under Advanced Configuration in CloudConnexa.

  7. Select Review + create.

  8. After validation succeeds, select Create.

    • Wait for Azure to finish deploying the connection.

Step 7: Create the second Azure VPN connection (optional

Because the Azure virtual network gateway uses active-active mode, create a second connection for the second Azure gateway instance.

Repeat the procedure from Step 6 with the following changes:

  • Enter a unique connection name.

  • Associate the connection with the second Azure gateway instance or public IP configuration, as required by the Azure portal.

  • Enter the pre-shared key configured for Tunnel 2 in CloudConnexa.

  • Use the same local network gateway and custom IPsec/IKE policy settings.

After validation succeeds, create the connection and wait for deployment to finish.

Note

The exact Azure interface for creating the second active-active connection may vary. Ensure that each CloudConnexa tunnel corresponds to a different public IP address on the Azure virtual network gateway.

Step 8: Verify connectivity

After configuring the tunnels on both sides:

  1. Return to the CloudConnexa Network Configuration Wizard.

  2. Select Test Connection.

  3. Review the connection result.

    • CloudConnexa attempts to establish connectivity to the Azure VNet through the configured tunnels.

  4. You can also select View Logs to review tunnel activity and troubleshoot unsuccessful connection attempts.

If the test fails, verify that:

  • The Azure gateway public IP addresses match the Connector Public IP Address values entered in CloudConnexa.

  • The pre-shared key for each tunnel matches the corresponding Azure connection.

  • The Azure local network gateway contains every CloudConnexa address space displayed in the wizard.

  • The Azure VPN connections use the custom IPsec/IKE values displayed by CloudConnexa.

  • BGP is disabled.

  • Use policy based traffic selector is enabled.

  • The Azure virtual network gateway uses active-active mode.

After the connection test succeeds, select Next and continue through the Network Configuration Wizard.

In this section: