Azure Network Gateway
This page shows how to write Terraform and Azure Resource Manager for Network Gateway and write them securely.
azurerm_vpn_gateway (Terraform)
The Gateway in Network can be configured in Terraform with the resource name azurerm_vpn_gateway
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_vpn_gateway" "microhack-we-hub-vng" {
name = "microhack-we-hub-vng"
location = var.location-vwan-we-hub
resource_group_name = azurerm_resource_group.vwan-microhack-hub-rg.name
virtual_hub_id = azurerm_virtual_hub.microhack-we-hub.id
resource "azurerm_vpn_gateway" "s2s_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_s2s ? 1 : 0
name = azurecaf_naming_convention.s2s_gateway.0.result
location = var.location
resource "azurerm_vpn_gateway" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
scale_unit = var.scale_unit
tags = var.tags
resource "azurerm_vpn_gateway" "test" {
name = "cwan-vpngateway"
location = azurerm_resource_group.test.location
resource_group_name = azurerm_resource_group.test.name
virtual_hub_id = azurerm_virtual_hub.test.id
}
resource "azurerm_vpn_gateway" "s2s_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_s2s ? 1 : 0
name = azurecaf_naming_convention.s2s_gateway.0.result
location = var.location
resource "azurerm_vpn_gateway" "VPNGW-HUB-WestEurope" {
location = "WestEurope"
name = "VPNGW-HUB-WestEurope"
resource_group_name = var.lab-rg
virtual_hub_id = azurerm_virtual_hub.HUB-WestEurope.id
tags = var.tags
resource "azurerm_vpn_gateway" "s2s_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_s2s ? 1 : 0
name = azurecaf_name.s2s_gateway.0.result
location = var.location
resource "azurerm_vpn_gateway" "canadacentral" {
name = "canadacentral-vpngw"
location = "canadacentral"
resource_group_name = azurerm_resource_group.global.name
virtual_hub_id = azurerm_virtual_hub.all["canadacentral"].id
}
resource "azurerm_vpn_gateway" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
scale_unit = var.scale_unit
tags = var.tags
resource "azurerm_vpn_gateway" "s2s_gateway" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = try(var.virtual_hub_config.deploy_s2s, false) ? 1 : 0
name = azurecaf_name.s2s_gateway.0.result
location = var.location
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
scale_unit
optional - number -
tags
optional - map from string to string -
virtual_hub_id
required - string -
bgp_settings
list block-
asn
required - number -
bgp_peering_address
optional computed - string -
peer_weight
required - number -
instance_0_bgp_peering_address
list block-
custom_ips
required - set of string -
default_ips
optional computed - set of string -
ip_configuration_id
optional computed - string -
tunnel_ips
optional computed - set of string
-
-
instance_1_bgp_peering_address
list block-
custom_ips
required - set of string -
default_ips
optional computed - set of string -
ip_configuration_id
optional computed - string -
tunnel_ips
optional computed - set of string
-
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a VPN Gateway within a Virtual Hub, which enables Site-to-Site communication.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/vpnGateways (Azure Resource Manager)
The vpnGateways in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/vpnGateways
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
"type": "Microsoft.Network/vpnGateways",
"properties": {
"provisioningState": "Succeeded",
"virtualHub": {
"id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualHubs/virtualHub1"
},
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredvirtualHub
optionalid
required - stringResource ID.
connections
optional arrayproperties
optionalremoteVpnSite
optionalid
required - stringResource ID.
routingWeight
optional - integerRouting weight for vpn connection.
dpdTimeoutSeconds
optional - integerDPD timeout in seconds for vpn connection.
connectionStatus
optional - stringThe connection status.
vpnConnectionProtocolType
optional - stringConnection protocol used for this connection.
connectionBandwidth
optional - integerExpected bandwidth in MBPS.
sharedKey
optional - stringSharedKey for the vpn connection.
enableBgp
optional - booleanEnableBgp flag.
usePolicyBasedTrafficSelectors
optional - booleanEnable policy-based traffic selectors.
ipsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
trafficSelectorPolicies
optional arraylocalAddressRanges
required - arrayA collection of local address spaces in CIDR format.
remoteAddressRanges
required - arrayA collection of remote address spaces in CIDR format.
enableRateLimiting
optional - booleanEnableBgp flag.
enableInternetSecurity
optional - booleanEnable internet security.
useLocalAzureIpAddress
optional - booleanUse local azure ip to initiate connection.
vpnLinkConnections
optional arrayproperties
optionalvpnSiteLink
optionalid
required - stringResource ID.
routingWeight
optional - integerRouting weight for vpn connection.
vpnLinkConnectionMode
optional - stringVpn link connection mode.
connectionStatus
optional - stringThe connection status.
vpnConnectionProtocolType
optional - stringConnection protocol used for this connection.
connectionBandwidth
optional - integerExpected bandwidth in MBPS.
sharedKey
optional - stringSharedKey for the vpn connection.
enableBgp
optional - booleanEnableBgp flag.
usePolicyBasedTrafficSelectors
optional - booleanEnable policy-based traffic selectors.
ipsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
enableRateLimiting
optional - booleanEnableBgp flag.
useLocalAzureIpAddress
optional - booleanUse local azure ip to initiate connection.
ingressNatRules
optional arrayid
required - stringResource ID.
egressNatRules
optional arrayid
required - stringResource ID.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
routingConfiguration
optionalassociatedRouteTable
optionalid
required - stringResource ID.
propagatedRouteTables
optionallabels
optional - arrayThe list of labels.
ids
optional arrayid
required - stringResource ID.
vnetRoutes
optionalstaticRoutes
optional arrayname
optional - stringThe name of the StaticRoute that is unique within a VnetRoute.
addressPrefixes
optional - arrayList of all address prefixes.
nextHopIpAddress
optional - stringThe ip address of the next hop.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
bgpSettings
optionalasn
optional - integerThe BGP speaker's ASN.
bgpPeeringAddress
optional - stringThe BGP peering address and BGP identifier of this BGP speaker.
peerWeight
optional - integerThe weight added to routes learned from this BGP speaker.
bgpPeeringAddresses
optional arrayipconfigurationId
optional - stringThe ID of IP configuration which belongs to gateway.
customBgpIpAddresses
optional - arrayThe list of custom BGP peering addresses which belong to IP configuration.
vpnGatewayScaleUnit
optional - integerThe scale unit for this vpn gateway.
isRoutingPreferenceInternet
optional - booleanEnable Routing Preference property for the Public IP Interface of the VpnGateway.
natRules
optional arrayproperties
optionaltype
optional - stringThe type of NAT rule for VPN NAT.
mode
optional - stringThe Source NAT direction of a VPN NAT.
internalMappings
optional arrayaddressSpace
optional - stringAddress space for Vpn NatRule mapping.
externalMappings
optional arrayaddressSpace
optional - stringAddress space for Vpn NatRule mapping.
ipConfigurationId
optional - stringThe IP Configuration ID this NAT rule applies to.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
Frequently asked questions
What is Azure Network Gateway?
Azure Network Gateway is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Gateway?
For Terraform, the mddazure/azure-vwan-microhack, tushar7653/testcaf and kevinhead/azurerm source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the debhol/azuredocs, debhol/azuredocs and debhol/azuredocs source code examples are useful. See the Azure Resource Manager Example section for further details.