Design and Implement Hybrid Network Connectivity with VPN Gateway

Most organizations do not have cloud-only environments (that is, migrating all their workloads to the cloud). Instead, they maintain both on-premises networks and Azure networks, which gives them the flexibility to choose where to best host a workload according to business requirements.
By default, remote networks and remote users can’t communicate with workloads in Azure VNets. We can enable access for both scenarios by implementing an Azure VPN gateway and configuring routing to pass traffic through the connection.
In this chapter, we will cover the implementation of a remote network and user connectivity using the VPN Gateway service. By the end of this chapter, you will have a strong understanding of the following:

• Choosing the right VPN Gateway SKU and generation
• Selecting between route-based and policy-based implementations
• Third-party device compatibility with VPN Gateway
• Implementing...

Technical requirements

To follow along with the instructions in this chapter, you will need the following:

• A PC with an internet connection
• An Azure subscription

Before we proceed to cover the security best practices, let us prepare our Azure subscription for the hands-on exercises that we will be completing later in the chapter.

Understanding Azure hybrid network connection options

Hybrid networks connect on-premises networks and remote users to Azure VNet resources. Azure hybrid network connectivity is powered by the Azure Virtual Network Gateway service. The service supports two types of gateway – the Virtual Private Network (VPN) gateway and the ExpressRoute gateway (Figure 5.1).
This chapter focuses on the VPN gateway option. We will cover the ExpressRoute gateway option in the next chapter.

Figure 5.1 – Azure virtual network gateway types

Understanding the Azure VPN gateway

As mentioned earlier, the Azure VPN gateway is one of the gateway options supported by the Azure Virtual Network Gateway service. The VPN gateway type supports the following hybrid connection options:

• Site-to-site (S2S) VPN connection over IPsec (IKE v1 and IKE v2): This option can be used to connect a remote network or multiple remote networks to an Azure VNet. This option relies...

Hands-on exercise – provision resources for chapter exercises

To follow along with the exercises in this chapter, we will provision some Azure resources to work with. We have prepared an Azure ARM template in the GitHub repository of this book for this purpose. The template will deploy two peered virtual networks in two Azure regions as shown in Figure 5.16.

Figure 5.16 – Resources deployed via the provided ARM template

The first VNet (CoreServicesVNet) will have two subnets with a virtual machine in the data subnet. The second VNet (onprem-network) will be used to simulate an on-premises network. It has four subnets and a virtual machine (OnPremVM) that will be used to simulate an on-premises VM.
A VM called Remote PC will also be deployed to simulate a remote user’s PC. Here is the task that we will complete in this exercise:

• Task 1: Initialize template deployment in GitHub, complete parameters, and deploy the template to...

Hands-on exercise: implement a BGP-enabled VPN connection in Azure

Here are the tasks that we will complete in this exercise:

• Task 1: Create the gateway subnet
• Task 2: Deploy the VPN gateway into the subnet (with an existing public IP)
• Task 3: Create the local network gateway
• Task 4: Configure the VPN connection
• Task 5: Verify VPN connection status and BGP peering
• Task 6: Verify connectivity between the on-premises network and the Azure VNet

Let’s get into this!

Task 1: Create the gateway subnet

To implement a VPN gateway, the first thing to do is to create a gateway subnet in our hub VNet called GatewaySubnet (the subnet cannot be named anything else). Also, this must be a dedicated subnet, which means no other resource should be deployed into it apart from the gateway.
During creation, we need to specify the subnet address range. This defines the number of IP addresses that will be available to the gateway service for allocation. The...

Understanding point-to-site connections

To implement a P2S VPN, we need to specify three main configuration settings: a client address pool, a tunnel type, and an authentication type. Let’s look at considerations for selecting the right configuration for our use cases.

Defining a connection pool for P2S VPN connectivity

The client address pool defines the range of IP addresses that will be assigned to connecting clients. P2S VPN clients that connect to the gateway will automatically receive an IP address from the defined range (Figure 5.36).

Figure 5.36 – Client address space assignment from address pool

The IP address range that you specify must not overlap with the VNet’s address range or you will receive an error similar to the one shown in Figure 5.37. In my case, my VNet address space is 10.10.0.0/16 and when I tried to configure a point-to-site address pool of 10.10.100.0/24, which falls within the range of the VNet’...

Hands-on exercise – implement a P2S VPN connection with Azure certificate authentication

Here are the tasks that we will complete in this exercise:

• Task 1: Connect to the remote user’s PC via RDP
• Task 2: Configure the point-to-site VPN gateway settings
• Task 3: Configure settings for VPN clients
• Task 4: Verify connectivity between the remote PC and the Azure VNet

Let’s get into this!

Task 1: Connect to the remote user’s PC via RDP

1. On your client system, open an RDP client and enter the remotePC-FQDN value that you made a note of in the first exercise in this chapter. Click on Connect. The instructions here describe the use of a Windows RDP client. If you are using a different RDP client, the instructions may be different for you.

To open the Windows RDP client, execute mstsc from the Windows run dialog, or type mstsc in the Windows start menu.

Figure 5.40 – Connect to the Windows...

Troubleshoot Azure VPN Gateway using diagnostic logs

Using diagnostic logs, you can troubleshoot multiple VPN gateway-related events including configuration activity, VPN tunnel connectivity, IPsec logging, BGP route exchanges, and point-to-site advanced logging.
There are several diagnostic logs you can use to help troubleshoot a problem with your VPN gateway:

• GatewayDiagnosticLog: This log contains diagnostic logs for the gateway, including configuration changes and maintenance events.
• TunnelDiagnosticLog: This log contains tunnel state change events. This log is useful to review the historical connectivity status of the tunnels (connect/disconnect events), including the reason for the state change. Once a concerning connect/disconnect event is identified, a more detailed analysis can be done with IKEdiagnosticLog.
• RouteDiagnosticLog: This log contains routing logs, including changes to static routes and BGP events.
• IKEDiagnosticLog: This log contains IKE control...

Hands-on exercise – clean up resources

In this exercise, we will remove the resources that we created in the chapter exercises to avoid running up large costs in Azure!
In Cloud Shell, run the following command to delete the CharisTechRG-C5 resource group:
az group delete --name CharisTechRG-C5 --yes
This will remove all the resources that we created for the exercises in this chapter.

Summary

In this chapter, we covered both site-to-site and point-to-site VPN connection options in Azure, including how to select the right size, choose the right type, define the right availability, and implement it in practice.
In the next chapter, we will cover another critical hybrid connectivity component – ExpressRoute. See you there!