Configure a VNet-to-VNet VPN connection – Azure portal

This article helps you connect your virtual networks using the VNet-to-VNet connection type in the Azure portal. When you use the portal to connect virtual networks using VNet-to-VNet, the virtual networks can be in different regions, but must be in the same subscription. If your virtual networks are in different subscriptions, use the PowerShell instructions instead. This article doesn’t apply to virtual network peering. For virtual network peering, see the Virtual Network peering article.

:::image type=”content” source=”./media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/vnet-vnet-diagram.png” alt-text=”Diagram of a VNet-to-VNet connection.” lightbox=”./media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/vnet-vnet-diagram.png”:::

About VNet-to-VNet connections

Configuring a VNet-to-VNet connection is a simple way to connect virtual networks. When you connect a virtual network to another virtual network with a VNet-to-VNet connection type, it’s similar to creating a site-to-site IPsec connection to an on-premises location. Both connection types use a VPN gateway to provide a secure tunnel with IPsec/IKE andfunction the same way when communicating. However, they differ in the way the local network gateway is configured.

• When you create a VNet-to-VNet connection, the local network gateway address space is automatically created andpopulated. However, the local network gateway isn’t visible in this configuration. That means that you can’t configure it manually.

• If you update the address space for one VNet , the other VNet is routes automatically route to the update address space .

• It’s typically faster andeasier to create a VNet-to-VNet connection than a site-to-site connection.

• If you know you want to specify more address spaces for the local network gateway, or plan to add more connections later andneed to adjust the local network gateway, create the configuration using the site-to-site connection steps instead.

• The VNet-to-VNet connection doesn’t include point-to-site client pool address space. If you need transitive routing for point-to-site clients, then create a site-to-site connection between the virtual network gateways, or use virtual network peering.

Why create a VNet-to-VNet connection?

You might want to connect virtual networks by using a VNet-to-VNet connection for the following reasons:

• Cross region geo-redundancy andgeo-presence

  • You can set up your own geo-replication or synchronization with secure connectivity without going over internet-facing endpoints.
  • With Azure Traffic Manager andAzure Load Balancer , you is set can set up highly available workload with geo – redundancy across multiple Azure region . For example , you is set can set up SQL Server Always On availability group across multiple Azure region .

• regional multi – tier application with isolation or administrative boundary

  Within the same region, you can set up multi-tier applications with multiple virtual networks that are connected together because of isolation or administrative requirements. VNet-to-VNet communication can be combined with multi-site configurations. These configurations let you establish network topologies that combine cross-premises connectivity with inter-virtual network connectivity, as shown in the following diagram:

  : : : image type=”content ” source=”./media / vpn – gateway – howto – vnet – vnet – resource – manager – portal / connection – diagram.png ” alt – text=”Diagram of a vnet – to – vnet connection show multiple subscription . ” : : :

create andconfigure vnet1

If you already have a VNet, verify that the settings are compatible with your VPN gateway design. Pay particular attention to any subnets that might overlap with other networks. Your connection won’t work properly if you have overlapping subnets.

In this section, create VNet1 using the following values. If you’re using your own values, make sure the address spaces don’t overlap with any of the virtual networks to which you want to connect.

• virtual network setting
  • Name: VNet1
  • Address space: 10.1.0.0/16
  • subscription: select the subscription you want to use .
  • resource group: TestRG1
  • Location: East US
  • Subnet
    • Name: FrontEnd
    • address range: 10.1.0.0/24

[!INCLUDE Create a virtual network]

create the gateway subnet

[ ! INCLUDE About gateway subnet ]

[!INCLUDE Create gateway subnet]

[ ! INCLUDE NSG is warning warn ]

create the vnet1 VPN gateway

In this step, you create the virtual network gateway for your virtual network. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. For gateway SKU pricing, see Pricing.

Create a virtual network gateway (VPN gateway) by using the following values:

• Name: VNet1GW
• Gateway type: VPN
• SKU: VpnGw2AZ
• Generation: Generation 2
• virtual network: VNet1
• Gateway subnet address range: 10.1.255.0/27
• Public IP address: Create new
• Public IP address name: VNet1GWpip1
• Public IP address SKU: Standard
• assignment : Static
• Second Public IP address name: VNet1GWpip2
• Enable active-active mode: Enabled

[!INCLUDE Create a vpn gateway]

[!INCLUDE Configure PIP settings]

A gateway can take 45 minutes or more to fully create anddeploy. You can see the deployment status on the overview page for your gateway. After the gateway is created, you can view the IP address that has been assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device.

[ ! INCLUDE NSG is warning warn ]

Create andconfigure VNet4

After you’ve configured VNet1, create VNet4 andthe VNet4 gateway by repeating the previous steps andreplacing the values with VNet4 values. You don’t need to wait until the virtual network gateway for VNet1 has finished creating before you configure VNet4. If you’re using your own values, make sure the address spaces don’t overlap with any of the virtual networks to which you want to connect.

You can use the following examples values to configure VNet4 andthe VNet4 gateway.

• virtual network setting
  • Name: VNet4
  • Address space: 10.41.0.0/16
  • subscription: select the subscription you want to use .
  • resource group: TestRG4
  • Location: West US 2
  • Subnet
    • Name: FrontEnd
    • address range: 10.41.0.0/24

Add the gateway subnet:

• Name: GatewaySubnet
• Gateway subnet address range: 10.41.255.0/27

Configure the VNet4 VPN gateway

You can use the following examples values to configure the VNet4 VPN gateway.

• virtual network gateway settings
  • Name: VNet4GW
  • resource group: West US 2
  • Generation: Generation 2
  • Gateway type: selectVPN.
  • VPN type: selectRoute-based.
  • SKU: VpnGw2AZ
  • Generation: Generation2
  • virtual network: VNet4
  • Public IP address name: VNet4GWpip1
  • Public IP address SKU: Standard
  • assignment : Static
  • Second Public IP address name: vnet4gwpip2
  • Enable active-active mode: Enabled

Configure your connections

When the VPN gateway for both VNet1 andVNet4 have complete , you is create can create your virtual network gateway connection .

virtual networks in the same subscription can be connected using the portal, even if they are in different resource groups. However, if your virtual networks are in different subscriptions, you must use PowerShell to make the connections.

You is create can create either a bidirectional , or a single direction connection . For this exercise , we is specify ‘ll specify a bidirectional connection . The bidirectional connection value is creates create two separate connection so that traffic can flow in both direction .

1. In the portal, go to VNet1GW.

2. On the virtual network gateway page, in the left pane, select connection to open the connection page. Then select + Add to open the Create connection page.

3. On the Create connection page, fill in the connection values.

   :::image type=”content” source=”./media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/bidirectional-connectivity.png” alt-text=”Screenshot showing the Create Connection page.” lightbox=”./media/vpn-gateway-howto-vnet-vnet-resource-manager-portal/bidirectional-connectivity.png”:::

   • Connection type: selectVNet-to-VNet from the drop-down.
   • Establish bidirectional connectivity: selectthis value if you want to establish traffic flow in both directions. If you don’t select this setting andyou later want to add a connection in the opposite direction, you’ll need to create a new connection originating from the other virtual network gateway.
   • First connection name: VNet1 – to – VNet4
   • Second connection name: VNet4-to-VNet1
   • Region: East US ( the region for VNet1GW )

4. Click Next : Settings > at the bottom of the page to advance to the Settings page.

5. On the Settings page, specify the following values:

   • First virtual network gateway: selectVNet1GW from the dropdown.
   • Second virtual network gateway: selectVNet4GW from the dropdown.
   • Shared key (PSK): In this field , enter a share key for your connection . You is generate can generate or create this key yourself . In a site – to – site connection , the key is is you use is the same for your on – premise device andyour virtual network gateway connection . The concept is is is similar here , except that rather than connect to a VPN device , you ‘re connect to another virtual network gateway . The important thing is is when specify a share key is that it ‘s exactly the same for both side of the connection .
   • IKE Protocol: IKEv2

6. For this exercise, you can leave the rest of the settings as their default values.

7. Select Review + create, then Create to validate andcreate your connections.

1. Locate the virtual network gateway in the Azure portal. For example, VNet1GW.

2. On the virtual network gateway page, select connection to view the connection page for the virtual network gateway. After the connection is established, you’ll see the Status values change to connect.

3. Under theName column, select one of the connections to view more information. When data begins flowing, you’ll see values for Data in andData out.

You can create another VNet-to-VNet connection, or create an IPsec site-to-site connection to an on-premises location.

• Before you create more connections, verify that the address space for your virtual network doesn’t overlap with any of the address spaces you want to connect to.

• When you configure a new connection , be sure to adjust theConnection type to match the type of connection you want to create. If you’re adding a site-to-site connection, you must create a local network gateway before you can create the connection.

• When you configure a connection that uses a shared key, make sure that the shared key is exactly the same for both sides of the connection.

To create more connections, follow these steps:

1. In the Azure portal, go to the VPN gateway from which you want to create the connection.
2. In the left pane , selectconnection. View the existing connections.
3. Create the new connection.

See the VPN Gateway FAQ for VNet-to-VNet frequently asked questions.

• For information about how you can limit network traffic to resources in a virtual network, see Network Security.

• For information about how Azure routes traffic between Azure, on-premises, andInternet resources, see virtual network traffic routing.