Azure Network Local Network Gateway
This page shows how to write Terraform and Azure Resource Manager for Network Local Network Gateway and write them securely.
azurerm_local_network_gateway (Terraform)
The Local Network Gateway in Network can be configured in Terraform with the resource name azurerm_local_network_gateway
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_local_network_gateway" "local_network_gateway_1_tunnel1"{
name="local_network_gateway_1_tunnel1"
location=azurerm_resource_group.resource_group.location
resource "azurerm_local_network_gateway" "local-network-gateway-1-tunnel1" {
name = "local-network-gateway-1-tunnel1"
location = azurerm_resource_group.az-resource-group.location
resource_group_name = azurerm_resource_group.az-resource-group.name
gateway_address = aws_vpn_connection.vpn-connection-1.tunnel1_address
address_space = [aws_vpc.vpc-main.cidr_block]
resource "azurerm_local_network_gateway" "local_network_gateway_1_tunnel1" {
name = var.tunnel1_name
location = var.resource_group.location
resource_group_name = var.resource_group.name
# AWS VPN Connection public IP address
gateway_address = var.aws_vpn_connection_tunnel1_address
resource "azurerm_local_network_gateway" "local_network_gtwy_1_tunl_1" {
name = "local_network_gtwy_1_tunl_1"
location = azurerm_resource_group.resource_group.location
resource_group_name = azurerm_resource_group.resource_group.name
# AWS VPN Connection public IP address
gateway_address = aws_vpn_connection.vpn_connection_1.tunnel1_address
resource "azurerm_local_network_gateway" "local_network_gateway_1_tunnel1" {
name = "local_network_gateway_1_tunnel1"
location = azurerm_resource_group.resource_group.location
resource_group_name = azurerm_resource_group.resource_group.name
# AWS VPN Connection public IP address
resource "azurerm_local_network_gateway" "aws1" {
name = "aws-gateway-1"
resource_group_name = var.azure_resource_group_name
location = var.azure_location
gateway_address = aws_vpn_connection.azure.tunnel1_address
resource "azurerm_local_network_gateway" "az_aws_lgw1" {
name = var.az_local_gw1_name
resource_group_name = var.resource_group
location = var.az_region
resource "azurerm_local_network_gateway" "remotePeers" {
count = length(var.remote_vpnconns)
name = format("azureGw-%d", count.index)
location = var.rg_location
resource_group_name = var.rg_name
resource "azurerm_local_network_gateway" "this" {
for_each = var.local_network_gateways
name = each.value["name"]
resource_group_name = var.resource_group_name
location = var.location
address_space = each.value["address_space"]
resource "azurerm_local_network_gateway" "local_network_gateway_1_tunnel1" {
name = "local_network_gateway_1_tunnel1"
location = azurerm_resource_group.resource_group.location
resource_group_name = azurerm_resource_group.resource_group.name
# AWS VPN Connection public IP address
Parameters
-
address_space
optional - list of string -
gateway_address
optional - string -
gateway_fqdn
optional - string -
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
bgp_settings
list block-
asn
required - number -
bgp_peering_address
required - string -
peer_weight
optional computed - number
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a local network gateway connection over which specific connections can be configured.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/localNetworkGateways (Azure Resource Manager)
The localNetworkGateways in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/localNetworkGateways
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/localNetworkGateways",
"name": "branch-ne-we-hub-config0",
"location": "northeurope",
"apiVersion": "2018-12-01",
"properties": {
"localNetworkAddressSpace": {
"type": "Microsoft.Network/localNetworkGateways",
"apiVersion": "2019-02-01",
"location": "[resourceGroup().location]",
"properties": {
"localNetworkAddressSpace": {
"addressPrefixes": [
"type": "Microsoft.Network/localNetworkGateways",
"name": "[variables('vnet1LocalGWName')]",
"location": "[parameters('vnet1Location')]",
"tags": { "displayName": "Local gateway for vnet2" },
"properties": {
"localNetworkAddressSpace": {
"type": "Microsoft.Network/localNetworkGateways",
"name": "[variables('vnet1LocalGWName')]",
"location": "[parameters('vnet1Location')]",
"tags": {
"displayName": "Local gateway for vnet2"
},
"type": "Microsoft.Network/localNetworkGateways",
"apiVersion": "2020-05-01",
"name": "[parameters('hubLng01Name')]",
"location": "[parameters('location')]",
"tags": {
"Owner": "Block Solutions",
"type": "Microsoft.Network/localNetworkGateways",
"name": "[concat('lgw-', parameters('singleVnetObject').env, '-' , parameters('singleVnetObject').vpnConnections[copyindex()].peerName)]",
"location": "[resourceGroup().location]",
"properties": {
"localNetworkAddressSpace": {
"addressPrefixes": "[parameters('singleVnetObject').vpnConnections[copyindex()].addressPrefixes]"
"type": "Microsoft.Network/localNetworkGateways",
"apiVersion": "[providers('Microsoft.Network','localNetworkGateways').apiVersions[0]]",
"location": "[parameters('location')]",
"properties": {
"localNetworkAddressSpace": {
"addressPrefixes": "[parameters('addressPrefixes')]"
"type": "Microsoft.Network/localNetworkGateways",
"apiVersion": "2020-05-01",
"name": "[variables('localNetworkGatewayName')]",
"location": "[resourceGroup().location]",
"tags": "[parameters('localgateway').tags]",
"properties": "[parameters('localgateway').properties]"
"type": "Microsoft.Network/localNetworkGateways",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"localNetworkAddressSpace": {
"type": "Microsoft.Network/localNetworkGateways",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"localNetworkAddressSpace": {
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredlocalNetworkAddressSpace
optionaladdressPrefixes
required - arrayA list of address blocks reserved for this virtual network in CIDR notation.
gatewayIpAddress
optional - stringIP address of local network gateway.
fqdn
optional - stringFQDN of local network gateway.
bgpSettings
optionalasn
optional - integerThe BGP speaker's ASN.
bgpPeeringAddress
optional - stringThe BGP peering address and BGP identifier of this BGP speaker.
peerWeight
optional - integerThe weight added to routes learned from this BGP speaker.
bgpPeeringAddresses
optional arrayipconfigurationId
optional - stringThe ID of IP configuration which belongs to gateway.
customBgpIpAddresses
optional - arrayThe list of custom BGP peering addresses which belong to IP configuration.
Frequently asked questions
What is Azure Network Local Network Gateway?
Azure Network Local Network Gateway is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Local Network Gateway?
For Terraform, the mukesh-ranjan/Hashicorp-Terraform-Associate-Certification-Preparation-Guide-LAB, narenarjun/terraform-aws-azure-s2s-vpn and ITEFARMAT/tf-aks source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the tkubica12/azure-virtual-wan, MaksimAniskov/aws-azure-hybrid and OzmanHamid/blueprints source code examples are useful. See the Azure Resource Manager Example section for further details.