Tutorial: Connect Azure to CloudConnexa with IPsec

Add a Network using the Network Configuration Wizard to represent your AWS VPC and select the IPsec Tunneling Protocol option.

In the Connector configuration step, select Azure from the Platform to Connect drop-down menu. Refer to CloudConnexa Connectors and About Network Connectors.

(Azure) Create a gateway subnet. Refer to Azure documentation. The virtual network gateway requires a specific subnet named GatewaySubnet. The gateway subnet is part of the IP address range for your virtual network and contains the IP addresses that the virtual network gateway resources and services use.

When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require more IP addresses than others. It's best to specify /27 or larger (/26, /25, etc.) for your gateway subnet.

1. On the page for your virtual network, on the left pane, select Subnets to open the Subnets page.

2. At the top of the page, select + Gateway subnet to open the Add subnet pane.

3. Select an appropriate Size. For example, /27.

4. Click Add.

(Azure) Create a local network gateway. Refer to Azure documentation. The local network gateway is a specific object deployed to Azure that represents the CloudConnexa Region (the site) for routing purposes. You give the site a name by which Azure can refer to it, and then specify the IP address of the site's VPN device to which you create a connection. You also specify the IP address prefixes that are routed through the VPN gateway to the site's VPN device (CloudConnexa Region). The address prefixes you specify are the prefixes located on your on-premises network.

1. In the Azure portal, go to Local network gateways and open the Create local network gateway page.

2. Click + Create on the Local network gateways page.

3. On the Basics tab, fill in the following fields:

   1. Resource Group: Select appropriately.

   2. Region: Select appropriately.

   3. Name: Enter name. For example, CloudConnexa

   4. IP address: Copy from CloudConnexa Admin Portal instructions.

   5. Address Spaces: Copy one-by-one from CloudConnexa Admin Portal instructions.

4. Click Next to move to the Advanced tab and set Configure BGP settings to NO.

5. Click Next to move to Review + create tab and click Create.

(Azure) Create a virtual network gateway (VPN gateway). Refer to Azure documentation.

1. In Search resources, services, and docs (G+/), enter virtual network gateway. Locate Virtual network gateway in the Marketplace search results and select it to open the Create virtual network gateway page. Click + Create.

2. On the Basics tab, fill in the following fields:

   1. Subscription: Select appropriately.

   2. Name: Enter name.

   3. Region: Select same Region as selected for local network gateway.

   4. Gateway Type: VPN

   5. SKU: Recommend to choose the default setting.

   6. Generation: Recommend to choose the default setting.

   7. Virtual Network: Seclect the one on which the GatewaySubnet was created.

   8. Specify the values for Public IP address. These settings specify the public IP address objects that will be associated to the VPN gateway. A public IP address is assigned to each public IP address object when the VPN gateway is created. Create or use existing Public IP address, enable Enable active-active mode, and create or use an existing SECOND PUBLIC IP ADDRESS.

   9. Set Configure BGP to Disabled.

3. Click Next: Tags >

4. Click Review + create to run validation.

5. After validation passes, select Create to deploy the VPN gateway.

A gateway can take 45 minutes or more to fully create and deploy. You can see the deployment status on the Overview page for your gateway.

From the Deployment Details section of the Azure Portal's VPN gateway Overview page, copy the two IP addresses and paste it in the Remote Site Public IPv4 Address fields of Tunnel 1 and Tunnel 2 in the Setup CloudConnexa Tunnel section of CloudConnexa Administration Portal.

Create one complex random string for use as PSK and enter it in the Pre-shared Key field for Tunnel 1 and Tunnel 2.

(Azure) Create a VPN connection. Refer to Azure documentation.

1. At the top of the Connections page, select + Create to open the Create connection page.

2. On the Create connection page, on the Basics tab, configure the values for your connection:

   1. Under Project details, select the subscription and the resource group where your resources are located.

   2. Under Instance details, configure the following settings:

      1. Connection type: Select Site-to-site (IPSec).

      2. Name: Name your connection. Region: Select the region for this connection.

      3. Region: Same as the previous created entities.

3. Click Next: Settings >

4. In the Settings tab, configure the following values:

   1. Virtual network gateway: Select the virtual network gateway from the dropdown list that was created in Step 7.

   2. Local network gateway: Select the local network gateway from the dropdown list that was created in Step 6.

   3. Shared key: The value here must match the value that was entered in Step 9.

   4. IKE Protocol: Select IKEv2.

   5. Use Azure Private IP Address: Don't select.

   6. Enable BGP: Don't select.

   7. IPsec/IKE policy: Select Custom and match all the values for the various fields with what is shown in the CloudConnexa portal. Encryption uses AES256, Integrity uses SHA256, DH Group is 14 and PFS Group is PFS2048. Change IPsec SA lifetime in seconds to 3600.

   8. Use policy based traffic selector: Select Enable.

   9. DPD timeout in seconds: Select 45.

   10. Connection Mode: Select ResponderOnly.

5. Click Next: Tags>.

6. Click Review + create to run validation.

7. After validation passes, click Create and wait till deployment is finished.

Click Test Connection 1 and Test Connection 2 to check connectivity for both the IPsec tunnels.

Continue with the network wizard instructions.