Azure Network Gateway Connection
This page shows how to write Terraform and Azure Resource Manager for Network Gateway Connection and write them securely.
azurerm_virtual_network_gateway_connection (Terraform)
The Gateway Connection in Network can be configured in Terraform with the resource name azurerm_virtual_network_gateway_connection
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_virtual_network_gateway_connection" "virtual_network_gateway_connection_1_tunnel1"{
name= "virtual_network_gateway_connection_1_tunnel1"
location =azurerm_resource_group.resource_group.location
resouce_group_name=azurerm_resource_group.resource_group.name
resource "azurerm_virtual_network_gateway_connection" "virtual_network_gateway_cxn_1_tunl_1" {
local_network_gateway_id = azurerm_local_network_gateway.local_network_gtwy_1_tunl_1.id
location = azurerm_resource_group.resource_group.location
name = "virtual_network_gateway_cxn_1_tunl_1"
resource_group_name = azurerm_resource_group.resource_group.name
shared_key = aws_vpn_connection.vpn_connection_1.tunnel1_preshared_key # AWS VPN Connection secret shared key
resource "azurerm_virtual_network_gateway_connection" "virtual_network_gateway_connection_1_tunnel1" {
name = var.tunnel1_gateway_name
location = var.resource_group.location
resource_group_name = var.resource_group.name
type = "IPsec"
virtual_network_gateway_id = azurerm_virtual_network_gateway.azure_virtual_network_gateway.id
resource "azurerm_virtual_network_gateway_connection" "virtual_network_gateway_connection_1_tunnel1" {
name = "virtual_network_gateway_connection_1_tunnel1"
location = azurerm_resource_group.resource_group.location
resource_group_name = azurerm_resource_group.resource_group.name
type = "IPsec"
resource "azurerm_virtual_network_gateway_connection" "connection_neu-to-weu" {
name = "neu-to-weu"
location = azurerm_resource_group.resource_group_neu.location
resource_group_name = azurerm_resource_group.resource_group_neu.name
type = "IPsec"
resource "azurerm_virtual_network_gateway_connection" "connection_eus-to-weu" {
name = "eus-to-weu"
location = azurerm_resource_group.resource_group_eus.location
resource_group_name = azurerm_resource_group.resource_group_eus.name
type = "IPsec"
resource "azurerm_virtual_network_gateway_connection" "connection_weu-to-neu" {
name = "weu-to-neu"
location = azurerm_resource_group.resource_group_weu.location
resource_group_name = azurerm_resource_group.resource_group_weu.name
type = "IPsec"
resource "azurerm_virtual_network_gateway_connection" "aws1" {
name = "aws-connection-1"
resource_group_name = var.azure_resource_group_name
location = var.azure_location
type = "IPsec"
resource "azurerm_virtual_network_gateway_connection" "virtual-network-gateway-connection-1-tunnel1" {
name = "virtual-network-gateway-connection-1-tunnel1"
location = azurerm_resource_group.az-resource-group.location
resource_group_name = azurerm_resource_group.az-resource-group.name
type = "IPSec"
virtual_network_gateway_id = azurerm_virtual_network_gateway.az-virtual-network-gateway.id
resource "azurerm_virtual_network_gateway_connection" "hub_to_onprem" {
name = "hub-onprem-connection"
location = azurerm_resource_group.hub.location
resource_group_name = azurerm_resource_group.hub.name
type = "Vnet2Vnet"
routing_weight = 1
Parameters
-
authorization_key
optional - string -
connection_protocol
optional computed - string -
dpd_timeout_seconds
optional - number -
enable_bgp
optional computed - bool -
express_route_circuit_id
optional - string -
express_route_gateway_bypass
optional computed - bool -
id
optional computed - string -
local_azure_ip_address_enabled
optional - bool -
local_network_gateway_id
optional - string -
location
required - string -
name
required - string -
peer_virtual_network_gateway_id
optional - string -
resource_group_name
required - string -
routing_weight
optional computed - number -
shared_key
optional - string -
tags
optional - map from string to string -
type
required - string -
use_policy_based_traffic_selectors
optional computed - bool -
virtual_network_gateway_id
required - string -
ipsec_policy
list block-
dh_group
required - string -
ike_encryption
required - string -
ike_integrity
required - string -
ipsec_encryption
required - string -
ipsec_integrity
required - string -
pfs_group
required - string -
sa_datasize
optional computed - number -
sa_lifetime
optional computed - number
-
-
timeouts
single block -
traffic_selector_policy
list block-
local_address_cidrs
required - list of string -
remote_address_cidrs
required - list of string
-
Explanation in Terraform Registry
Manages a connection in an existing Virtual Network Gateway.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/connections (Azure Resource Manager)
The connections in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/connections
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/connections",
"name": "branch-ne-to-we-hub0",
"apiVersion": "2018-12-01",
"location": "northeurope",
"dependsOn": [
"[concat('Microsoft.Network/localNetworkGateways/', 'branch-ne-we-hub-config0')]"
"type": "Microsoft.Network/connections",
"name": "[variables('connectionName11-21')]",
"apiVersion": "2020-06-01",
"comments": "VPN connection between [Gateway1] and [Gateway2-pubIP1]",
"location": "[variables('location1')]",
"dependsOn": [
"type": "Microsoft.Network/connections",
"name": "[parameters('connectionName1')]",
"location": "[parameters('location1')]",
"properties": {
"virtualNetworkGateway1": {
"id": "[parameters('gateway1Id')]"
"type": "Microsoft.Network/connections",
"name": "[variables('connectionName11-21')]",
"apiVersion": "2020-06-01",
"comments": "VPN connection between [Gateway1] and [Gateway2-pubIP1]",
"location": "[variables('location1')]",
"dependsOn": [
"type": "Microsoft.Network/connections",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"virtualNetworkGateway1": {
"type": "Microsoft.Network/connections",
"name": "Connection-WEU-NEU",
"apiVersion": "2017-10-01",
"location": "westeurope",
"scale": null,
"properties": {
"type": "Microsoft.Network/connections",
"apiVersion": "[variables('apiVersion')]",
"location": "[variables('location_1')]",
"properties": {
"publicIPAllocationMethod": "Dynamic",
"virtualNetworkGateway1": {
"type": "Microsoft.Network/connections",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"virtualNetworkGateway1": {
"type": "Microsoft.Network/connections",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"virtualNetworkGateway1": {
"type": "Microsoft.Network/connections",
"location": "centralus",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "00000000-0000-0000-0000-000000000000",
"virtualNetworkGateway1": {
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredauthorizationKey
optional - stringThe authorizationKey.
virtualNetworkGateway1
requiredid
required - stringResource ID.
virtualNetworkGateway2
optionalid
required - stringResource ID.
localNetworkGateway2
optionalid
required - stringResource ID.
connectionType
required - stringGateway connection type.
connectionProtocol
optional - stringConnection protocol used for this connection.
routingWeight
optional - integerThe routing weight.
dpdTimeoutSeconds
optional - integerThe dead peer detection timeout of this connection in seconds.
connectionMode
optional - stringThe connection mode for this connection.
sharedKey
optional - stringThe IPSec shared key.
peer
optionalid
required - stringResource ID.
enableBgp
optional - booleanEnableBgp flag.
useLocalAzureIpAddress
optional - booleanUse private local Azure IP for the connection.
usePolicyBasedTrafficSelectors
optional - booleanEnable policy-based traffic selectors.
ipsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
trafficSelectorPolicies
optional arraylocalAddressRanges
required - arrayA collection of local address spaces in CIDR format.
remoteAddressRanges
required - arrayA collection of remote address spaces in CIDR format.
expressRouteGatewayBypass
optional - booleanBypass ExpressRoute Gateway for data forwarding.
Frequently asked questions
What is Azure Network Gateway Connection?
Azure Network Gateway Connection is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Gateway Connection?
For Terraform, the mukesh-ranjan/Hashicorp-Terraform-Associate-Certification-Preparation-Guide-LAB, gmirsky/aws-azure-vpn and ITEFARMAT/tf-aks source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the tkubica12/azure-virtual-wan, fabferri/az-pattern and noendscripting/Azure-PoC-Template source code examples are useful. See the Azure Resource Manager Example section for further details.