Azure Network Gateway Connection
This page shows how to write Terraform and Azure Resource Manager for Network Gateway Connection and write them securely.
azurerm_vpn_gateway_connection (Terraform)
The Gateway Connection in Network can be configured in Terraform with the resource name azurerm_vpn_gateway_connection
. The following sections describe 9 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_vpn_gateway_connection" "az_vpngw_conn_1" {
name = var.vpn_connection_name1
remote_vpn_site_id = azurerm_vpn_site.az_vpnsite_1.id
vpn_gateway_id = azurerm_vpn_gateway.default.id
vpn_link {
name = "vpn_conn_1"
resource "azurerm_vpn_gateway_connection" "homelab1" {
name = "homelab1"
vpn_gateway_id = azurerm_vpn_gateway.canadacentral.id
remote_vpn_site_id = azurerm_vpn_site.homelab1.id
vpn_link {
resource "azurerm_vpn_gateway_connection" "microhack-vwan-eus2-onprem" {
name = "vwan-eus2-onprem"
vpn_gateway_id = azurerm_vpn_gateway.microhack-eus2-hub-vng.id
remote_vpn_site_id = azurerm_vpn_site.microhack-eus2-onprem-site.id
vpn_link {
name = "link1"
resource "azurerm_vpn_gateway_connection" "vpn_gateway_connection" {
name = azurecaf_name.vpn_gateway_connection.result
vpn_gateway_id = var.vpn_gateway_id
internet_security_enabled = var.settings.internet_security_enabled
remote_vpn_site_id = coalesce(
resource "azurerm_vpn_gateway_connection" "alpha" {
name = "alpha-connection"
vpn_gateway_id = data.terraform_remote_state.vwan.outputs.vpn_gateway.id
remote_vpn_site_id = azurerm_vpn_site.alpha.id
vpn_link {
resource "azurerm_vpn_gateway_connection" "beta" {
name = "beta-connection"
vpn_gateway_id = data.terraform_remote_state.vwan.outputs.vpn_gateway.id
remote_vpn_site_id = azurerm_vpn_site.beta.id
vpn_link {
resource "azurerm_vpn_gateway_connection" "vpn_gateway_connection" {
name = azurecaf_name.vpn_gateway_connection.result
vpn_gateway_id = var.vpn_gateway_id
internet_security_enabled = var.settings.internet_security_enabled
remote_vpn_site_id = coalesce(
resource "azurerm_vpn_gateway_connection" "vpn_gateway_connection" {
name = azurecaf_name.vpn_gateway_connection.result
vpn_gateway_id = var.vpn_gateway_id
internet_security_enabled = var.settings.internet_security_enabled
remote_vpn_site_id = coalesce(
resource "azurerm_vpn_gateway_connection" "connections" {
provider = azurerm.vwantarget
for_each = var.vwanVpnConnections
name = each.value["vpnConnName"]
vpn_gateway_id = each.value["vpnConnGtwyId"]
remote_vpn_site_id = each.value["vpnConnRemoteSiteId"]
Parameters
-
id
optional computed - string -
internet_security_enabled
optional - bool -
name
required - string -
remote_vpn_site_id
required - string -
vpn_gateway_id
required - string -
routing
list block-
associated_route_table
required - string -
propagated_route_tables
required - list of string
-
-
timeouts
single block -
vpn_link
list block-
bandwidth_mbps
optional - number -
bgp_enabled
optional - bool -
local_azure_ip_address_enabled
optional - bool -
name
required - string -
policy_based_traffic_selector_enabled
optional - bool -
protocol
optional - string -
ratelimit_enabled
optional - bool -
route_weight
optional - number -
shared_key
optional - string -
vpn_site_link_id
required - string -
ipsec_policy
list block-
dh_group
required - string -
encryption_algorithm
required - string -
ike_encryption_algorithm
required - string -
ike_integrity_algorithm
required - string -
integrity_algorithm
required - string -
pfs_group
required - string -
sa_data_size_kb
required - number -
sa_lifetime_sec
required - number
-
-
Explanation in Terraform Registry
Manages a VPN Gateway Connection.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/vpnGateways/vpnConnections (Azure Resource Manager)
The vpnGateways/vpnConnections in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/vpnGateways/vpnConnections
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
name
required - stringtype
required - stringapiVersion
required - stringproperties
requiredremoteVpnSite
optionalid
required - stringResource ID.
routingWeight
optional - integerRouting weight for vpn connection.
dpdTimeoutSeconds
optional - integerDPD timeout in seconds for vpn connection.
connectionStatus
optional - stringThe connection status.
vpnConnectionProtocolType
optional - stringConnection protocol used for this connection.
connectionBandwidth
optional - integerExpected bandwidth in MBPS.
sharedKey
optional - stringSharedKey for the vpn connection.
enableBgp
optional - booleanEnableBgp flag.
usePolicyBasedTrafficSelectors
optional - booleanEnable policy-based traffic selectors.
ipsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
trafficSelectorPolicies
optional arraylocalAddressRanges
required - arrayA collection of local address spaces in CIDR format.
remoteAddressRanges
required - arrayA collection of remote address spaces in CIDR format.
enableRateLimiting
optional - booleanEnableBgp flag.
enableInternetSecurity
optional - booleanEnable internet security.
useLocalAzureIpAddress
optional - booleanUse local azure ip to initiate connection.
vpnLinkConnections
optional arrayproperties
optionalvpnSiteLink
optionalid
required - stringResource ID.
routingWeight
optional - integerRouting weight for vpn connection.
vpnLinkConnectionMode
optional - stringVpn link connection mode.
connectionStatus
optional - stringThe connection status.
vpnConnectionProtocolType
optional - stringConnection protocol used for this connection.
connectionBandwidth
optional - integerExpected bandwidth in MBPS.
sharedKey
optional - stringSharedKey for the vpn connection.
enableBgp
optional - booleanEnableBgp flag.
usePolicyBasedTrafficSelectors
optional - booleanEnable policy-based traffic selectors.
ipsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
enableRateLimiting
optional - booleanEnableBgp flag.
useLocalAzureIpAddress
optional - booleanUse local azure ip to initiate connection.
ingressNatRules
optional arrayid
required - stringResource ID.
egressNatRules
optional arrayid
required - stringResource ID.
name
optional - stringThe name of the resource that is unique within a resource group. This name can be used to access the resource.
routingConfiguration
optionalassociatedRouteTable
optionalid
required - stringResource ID.
propagatedRouteTables
optionallabels
optional - arrayThe list of labels.
ids
optional arrayid
required - stringResource ID.
vnetRoutes
optionalstaticRoutes
optional arrayname
optional - stringThe name of the StaticRoute that is unique within a VnetRoute.
addressPrefixes
optional - arrayList of all address prefixes.
nextHopIpAddress
optional - stringThe ip address of the next hop.
Frequently asked questions
What is Azure Network Gateway Connection?
Azure Network Gateway Connection is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Gateway Connection?
For Terraform, the rickchen918/vwan, raykao/hub-spoke-environment and zipphreak/azure-vwan-microhack2.0 source code examples are useful. See the Terraform Example section for further details.