--- title: 'Tutorial: Connect Azure to CloudConnexa with IPsec' canonical: https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-azure-to-cloudconnexa-with-ipsec/ product: CloudConnexa Docs description: Learn how to connect your Azure VNet to CloudConnexa with a site-to-site IPsec VPN tunnel, giving CloudConnexa users and networks secure access to Azure. keywords: Azure IPsec --- # Tutorial: Connect Azure to CloudConnexa with IPsec ## Overview This tutorial shows how to connect your Microsoft Azure virtual network (VNet) to CloudConnexa using an [IPsec](https://openvpn.net/cloud-docs/owner/networks/networks---connectors/configure-an-ipsec-connector.md) site-to-site tunnel—without deploying a [Connector virtual machine](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-azure-vnet-to-cloudconnexa-by-deploying-a-connector.md) in your Azure environment. Unlike a [Connector-based deployment](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-azure-vnet-to-cloudconnexa-by-deploying-a-connector.md), IPsec uses Azure VPN Gateway to establish the connection. This means there is no Connector virtual machine to manage, but you need to configure the VPN on both the Azure side and in your CloudConnexa Administration portal. Once configured, the site-to-site IPsec tunnels connect your Azure VNet to the selected [CloudConnexa Region](https://openvpn.net/cloud-docs/owner/get-started/about-cloudconnexa/locations-of-cloudconnexa-regions.md). Your CloudConnexa users—and any other networks connected through CloudConnexa—can then access resources in the VNet privately, without exposing them to the public internet. ## Before you begin Before configuring the IPsec connection, ensure you have the following: - A [CloudConnexa account and Cloud ID](https://openvpn.net/cloud-docs/owner/get-started/create-a-cloudconnexa-account.md). - Administrator access to your CloudConnexa Administration portal. - An Azure subscription. - An existing Azure VNet to connect to CloudConnexa. - Permissions to create subnets, local network gateways, virtual network gateways, public IP addresses, and VPN connections in Azure. - Available address space in the VNet for a subnet named `GatewaySubnet`. - Confirm the VNet's address space doesn't overlap with any CloudConnexa address space shown in the configuration. > **Note** > > Azure rejects VPN connections when the two sides have overlapping ranges. Check this before creating the gateway subnet, not after. > **Note** > > Creating an Azure virtual network gateway can take 45 minutes or longer, depending on the selected gateway SKU. > **Tip** > > For Azure-specific prerequisites and current portal instructions, refer to the Microsoft documentation for creating a site-to-site VPN connection. ## Step 1: Configure the Network Connector in CloudConnexa 1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`). 2. Navigate to **Networks**. 3. Select **Add Network**. 4. Select the appropriate Network Scenario. 5. Configure the network details. 6. When prompted, select **IPsec** for your tunneling protocol. 7. On the **Configure Network Connector** page, select **Azure** from **Platform to Connect**. - CloudConnexa displays the values you need to configure the Azure gateways, tunnels, and VPN connection. 8. Under **Create Azure Gateways**, review and copy the following values: - **CloudConnexa Public IP Address:** Select the available CloudConnexa public IP address from the list. You'll enter this value as the Azure local network gateway. - **Address Spaces:** These are the CloudConnexa-side networks that Azure routes through the IPsec tunnel. - **BGP:** Configure BGP as displayed. The current configuration requires BCP to be disabled. 9. Also review the displayed virtual network gateway requirements: - **Type:** VPN - **SKU:** Any - **Generation:** Any - **Public IP Address:** New - **Active-Active Mode:** Enabled - **BGP:** Disabled > **Tip** > > Keep the CloudConnexa page open while configuring Azure so you can copy the displayed values into the corresponding Azure fields. 10. Under **Set Up CloudConnexa Tunnel**, review the fields, but don't enter the Azure gateway IP addresses yet. Azure assigns those addresses after creating the virtual network gateway. 11. Leave **Advanced Configuration** unchanged unless the Azure VPN configuration requires different IPsec parameters. 12. Open a new browser tab and sign in to the Azure portal. ## Step 2: Create the Azure gateway subnet Azure requires a dedicated subnet named `GatewaySubnet` for the virtual network gateway resources. 1. In the Azure portal, navigate to the VNet you're connecting to CloudConnexa. 2. Select **Settings → Subnets**. 3. Select **+ Subnet**. 4. Under **Subnet purpose**, select **Virtual Network Gateway**. - Azure automatically sets the subnet name to `GatewaySubnet`, and this can't be changed. 5. Under **IPv4**, set the **Starting address** and **Size** for the subnet. > **Tip** > > Microsoft recommends using a `/27` or larger subnet, such as `/26` or `/25`, to support the required gateway configuration. 6. Under **Private Subnet**, clear **Enable private subnet (no default outbound access)**. > **Important** > > Newer Azure virtual networks enable private subnets by default, which blocks outbound internet access. The virtual network gateway requires default outbound access to establish IPsec tunnels to CloudConnexa. Leaving this option enabled causes the tunnel to fail silently — Azure sends no response to CloudConnexa's connection attempts, and both Ingress and Egress byte counters on the Connection resource remain at 0. 7. Under **Security**, leave **NAT gateway**, **Network security group**, and **Route table** set to **None**. > **Important** > > Don't attach a NAT gateway, network security group, or route table to `GatewaySubnet`. Microsoft doesn't support these on the gateway subnet, and they can interfere with gateway traffic. 8. Leave **Private endpoint network policy** at its default (**Disabled**). 9. Select **Save** or **Add**, depending on the Azure portal interface. > **Important** > > Don't deploy application resources or other virtual machines to `GatewaySubnet`. ## Step 3: Create the Azure local network gateway The local network gateway represents the CloudConnexa Region and the networks reachable through it. 1. In the Azure portal, navigate to **Local network gateways**. 2. Select **+ Create**. 3. On the **Basics** tab, configure the following settings: - **Subscription:** Select the appropriate Azure subscription. - **Resource Group:** Select the resource group for the VPN resources. - **Region:** Select the Azure region for the gateway resources. - **Name:** Enter a descriptive name, such as `CloudConnexa`. - **Endpoint:** Select **IP address** when prompted. - **IP Address:** Enter the **CloudConnexa Public IP Address** displayed in CloudConnexa. - **Address Space:** Add each IP range displayed under **Address Spaces** in CloudConnexa. 4. Continue to the advanced configuration. 5. Ensure **Configure BGP settings** is set to **No** or disabled. 6. Select **Review + create**. 7. After validation succeeds, select **Create**. > **Important** > > Add every address space displayed in CloudConnexa. Missing ranges may prevent Azure from routing traffic to some CloudConnexa users or connected networks. ## Step 4: Create the Azure virtual network gateway The virtual network gateway provides the Azure-side VPN endpoints for the IPsec tunnels. 1. In the Azure portal, search for and select **Virtual network gateways**. 2. Select **+ Create**. 3. Configure the gateway: - **Subscription:** Select the appropriate subscription. - **Name:** Enter a name for the gateway. - **Region:** Select the region associated with the VNet. - **Gateway Type:** Select **VPN**. - **SKU:** Select a SKU that supports active-active mode. - **Generation:** Select a supported generation. - **Virtual Network:** Select the VNet containing the `GatewaySubnet`. 4. Under the public IP address settings: - Create or select the first public IP address. - Enable **Active-active mode**. - Create or select the second public IP address. 5. Ensure **Configure BGP** is disabled. 6. Select **Review + create**. 7. After validation succeeds, select **Create**. - Azure begins deploying the virtual network gateway. > **Note** > > Gateway deployment can take 45 minutes or longer. You can monitor the deployment status from the gateway's **Overview** page. 8. After deployment completes, locate the two public IP addresses assigned to the active-active virtual network gateway. You need these values to configure the CloudConnexa tunnels. ## Step 5: Set up the CloudConnexa tunnels 1. Return to the CloudConnexa Network Configuration Wizard. 2. In **Set Up CloudConnexa Tunnel**, enter: - **Connector Public IP Address:** Enter the first public IP address assigned to the Azure virtual network gateway. - **Pre-shared Key (PSK):** Enter a strong pre-shared key. 3. Configure tunnel 2 in the same manner. 4. Record the pre-shared keys. You must enter the corresponding key when creating each Azure VPN connection. 5. Leave the **Advanced Configuration** settings at their default values unless your environment requires different IPsec parameters. ## Step 6: Create the first Azure VPN connection Create a VPN connection between the Azure virtual network gateway and the CloudConnexa local network gateway. 1. In the Azure portal, navigate to **Connections**. 2. Select **+ Create**. 3. On the **Basics** tab, configure: - **Subscription:** Select the subscription containing the gateway resources. - **Resource Group:** Select the appropriate resource group. - **Connection Type:** Select **Site-to-site (IPsec)**. - **Name:** Enter a name for the first connection. - **Region:** Select the same region as the gateway resources. 4. Continue to the connection settings. 5. Configure: - **Virtual Network Gateway:** Select the virtual network gateway created earlier. - **Local Network Gateway:** Select the Azure local network gateway created earlier. - **Authentication type:** Select **Shared key**. - **Shared Key:** Enter the pre-shared key configured for **Tunnel 1** in CloudConnexa. - **IKE Protocol:** Select **IKEv2**. - **Use Azure Private IP Address**: Leave disabled. - **Enable BGP:** Leave disabled. - **IPsec/IKE Policy:** Select **Custom**. - **Use Policy Based Traffic Selector:** Select **Enable**. 6. Configure the custom IPsec/IKE policy to match the values displayed under **Advanced Configuration** in CloudConnexa. 7. Select **Review + create**. 8. After validation succeeds, select **Create**. - Wait for Azure to finish deploying the connection. ## Step 7: Create the second Azure VPN connection (optional Because the Azure virtual network gateway uses active-active mode, create a second connection for the second Azure gateway instance. We recommend using a different CloudConnexa data center IP address for each connection. Repeat the procedure from Step 6 with the following changes: - Enter a unique connection name. - Associate the connection with the second Azure gateway instance or public IP configuration, as required by the Azure portal. - Enter the pre-shared key configured for Tunnel 2 in CloudConnexa. - Use the same local network gateway and custom IPsec/IKE policy settings. After validation succeeds, create the connection and wait for deployment to finish. > **Note** > > The exact Azure interface for creating the second active-active connection may vary. Ensure that each CloudConnexa tunnel corresponds to a different public IP address on the Azure virtual network gateway. ## Step 8: Verify connectivity After configuring the tunnels on both sides: 1. Return to the CloudConnexa Network Configuration Wizard. 2. Select **Test Connection**. 3. Review the connection result. - CloudConnexa attempts to establish connectivity to the Azure VNet through the configured tunnels. 4. You can also select View Logs to review tunnel activity and troubleshoot unsuccessful connection attempts. If the test fails, verify that: - The Azure gateway public IP addresses match the **Connector Public IP Address** values entered in CloudConnexa. - The pre-shared key for each tunnel matches the corresponding Azure connection. - The Azure local network gateway contains every CloudConnexa address space displayed in the wizard. - The Azure VPN connections use the custom IPsec/IKE values displayed by CloudConnexa. - BGP is disabled. - **Use policy based traffic selector** is enabled. - The Azure virtual network gateway uses active-active mode. After the connection test succeeds, select **Next** and continue through the Network Configuration Wizard. ## Related Resources - [Configure a Generic IPsec Tunnel From Your Private Network to CloudConnexa](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/ipsec/tutorial--configure-a-generic-ipsec-tunnel-from-your-private-network-to-cloudconnexa.md) - [Connect Your Cisco Router to CloudConnexa with IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/routers/tutorial--connect-your-cisco-router-to-cloudconnexa-with-ipsec.md) - [Connect AWS VPC to CloudConnexa with IPsec using Transit Gateway](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-vpc-to-cloudconnexa-with-ipsec-using-transit-gateway.md) - [Connect AWS to CloudConnexa with IPsec using VPG](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-aws-to-cloudconnexa-with-ipsec-using-vpg.md) - [Connect Azure to CloudConnexa with IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-azure-to-cloudconnexa-with-ipsec.md) - [Connect Your GCP VPC to CloudConnexa using IPsec](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-gcp-vpc-to-cloudconnexa-using-ipsec.md) - [Video: Configure an IPsec connection to your AWS VPC](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-aws-vpc.md) - [Video: Configure an IPsec connection to your AWS VPC using Transit Gateway](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-aws-vpc-using-transit-gateway.md) - [Video: Configure an IPsec connection to your Azure VNet](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-azure-vnet.md) - [Video: Configure an IPsec connection to your GCP VPC](https://openvpn.net/cloud-docs/videos/configuration/connectors/video--configure-an-ipsec-connection-to-your-gcp-vpc.md) --- Prev: [Tutorial: Connect Your Azure VNet to CloudConnexa by Deploying a Connector](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-azure-vnet-to-cloudconnexa-by-deploying-a-connector.md) Next: [Tutorial: Connect Your GCP VPC to CloudConnexa by Deploying a Connector](https://openvpn.net/cloud-docs/tutorials/configuration-tutorials/connectors/iaas/tutorial--connect-your-gcp-vpc-to-cloudconnexa-by-deploying-a-connector.md) Index: https://openvpn.net/cloud-docs/llms.txt