Azure Network Server Configuration
This page shows how to write Terraform and Azure Resource Manager for Network Server Configuration and write them securely.
azurerm_vpn_server_configuration (Terraform)
The Server Configuration in Network can be configured in Terraform with the resource name azurerm_vpn_server_configuration
. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_p2s ? 1 : 0
name = azurecaf_naming_convention.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = try(var.virtual_hub_config.deploy_p2s, false) ? 1 : 0
name = azurecaf_name.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_p2s ? 1 : 0
name = azurecaf_name.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = try(var.virtual_hub_config.deploy_p2s, false) ? 1 : 0
name = azurecaf_name.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_p2s ? 1 : 0
name = azurecaf_naming_convention.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = try(var.virtual_hub_config.deploy_p2s, false) ? 1 : 0
name = azurecaf_name.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
tags = var.tags
vpn_authentication_types = var.vpn_authentication_types
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = var.virtual_hub_config.deploy_p2s ? 1 : 0
name = azurecaf_naming_convention.p2s_gateway.0.result
resource_group_name = var.resource_group_name
resource "azurerm_vpn_server_configuration" "this" {
location = var.location
name = var.name
resource_group_name = var.resource_group_name
tags = var.tags
vpn_authentication_types = var.vpn_authentication_types
resource "azurerm_vpn_server_configuration" "p2s_configuration" {
depends_on = [azurerm_virtual_hub.vwan_hub]
count = try(var.virtual_hub_config.deploy_p2s, false) ? 1 : 0
name = azurecaf_name.p2s_gateway.0.result
resource_group_name = var.resource_group_name
Parameters
-
id
optional computed - string -
location
required - string -
name
required - string -
resource_group_name
required - string -
tags
optional - map from string to string -
vpn_authentication_types
required - list of string -
vpn_protocols
optional computed - set of string -
azure_active_directory_authentication
list block -
client_revoked_certificate
set block-
name
required - string -
thumbprint
required - string
-
-
client_root_certificate
set block-
name
required - string -
public_cert_data
required - string
-
-
ipsec_policy
list block-
dh_group
required - string -
ike_encryption
required - string -
ike_integrity
required - string -
ipsec_encryption
required - string -
ipsec_integrity
required - string -
pfs_group
required - string -
sa_data_size_kilobytes
required - number -
sa_lifetime_seconds
required - number
-
-
radius
list block-
client_root_certificate
set block-
name
required - string -
thumbprint
required - string
-
-
server
list block -
server_root_certificate
set block-
name
required - string -
public_cert_data
required - string
-
-
-
radius_server
list block-
address
required - string -
secret
required - string -
client_root_certificate
set block-
name
required - string -
thumbprint
required - string
-
-
server_root_certificate
set block-
name
required - string -
public_cert_data
required - string
-
-
-
timeouts
single block
Explanation in Terraform Registry
Manages a VPN Server Configuration.
Tips: Best Practices for The Other Azure Network Resources
In addition to the azurerm_network_security_group, Azure Network has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
azurerm_network_security_group
Ensure to disable RDP port from the Internet
It is better to disable the RDP port from the Internet. RDP access should not be accepted from the Internet (*, 0.0.0.0, /0, internet, any), and consider using the Azure Bastion Service.
azurerm_network_security_rule
Ensure to set a more restrictive CIDR range for ingress from the internet
It is better to set a more restrictive CIDR range not to use very broad subnets. If possible, segments should be divided into smaller subnets.
azurerm_network_watcher_flow_log
Ensure to enable Retention policy for flow logs and set it to enough duration
It is better to enable a retention policy for flow logs. Flow logs show us all network activity in the cloud environment and support us when we face critical incidents.
Microsoft.Network/vpnServerConfigurations (Azure Resource Manager)
The vpnServerConfigurations in Microsoft.Network can be configured in Azure Resource Manager with the resource name Microsoft.Network/vpnServerConfigurations
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
"type": "Microsoft.Network/vpnServerConfigurations",
"copy": {
"name": "p2sGatewayConfigs",
"count": "[length(parameters('hubs'))]"
},
"condition": "[parameters('hubs')[copyIndex()].p2sGateway.shouldExist]",
"type": "Microsoft.Network/vpnServerConfigurations",
"apiVersion": "2020-05-01",
"name": "[format('{0}_P2SvpnServerConfiguration', variables('virtual_hub_cfg').name)]",
"location": "[parameters('Hub_Location')]",
"dependsOn": [
],
"type": "Microsoft.Network/vpnServerConfigurations",
"apiVersion": "2020-05-01",
"name": "[format('{0}_P2SvpnServerConfiguration', variables('virtual_hub1_cfg').name)]",
"location": "[parameters('hub1_location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/expressRouteGateways', format('{0}_ERGW', variables('virtual_hub1_cfg').name))]"
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
"type": "Microsoft.Network/vpnServerConfigurations",
"tags": {
"key1": "value1"
},
"properties": {
"provisioningState": "Succeeded",
Parameters
name
required - stringtype
required - stringapiVersion
required - stringlocation
required - stringResource location.
tags
optional - stringResource tags.
properties
requiredname
optional - stringThe name of the VpnServerConfiguration that is unique within a resource group.
vpnProtocols
optional - arrayVPN protocols for the VpnServerConfiguration.
vpnAuthenticationTypes
optional - arrayVPN authentication types for the VpnServerConfiguration.
vpnClientRootCertificates
optional arrayname
optional - stringThe certificate name.
publicCertData
optional - stringThe certificate public data.
vpnClientRevokedCertificates
optional arrayname
optional - stringThe certificate name.
thumbprint
optional - stringThe revoked VPN client certificate thumbprint.
radiusServerRootCertificates
optional arrayname
optional - stringThe certificate name.
publicCertData
optional - stringThe certificate public data.
radiusClientRootCertificates
optional arrayname
optional - stringThe certificate name.
thumbprint
optional - stringThe Radius client root certificate thumbprint.
vpnClientIpsecPolicies
optional arraysaLifeTimeSeconds
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.
saDataSizeKilobytes
required - integerThe IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.
ipsecEncryption
required - stringThe IPSec encryption algorithm (IKE phase 1).
ipsecIntegrity
required - stringThe IPSec integrity algorithm (IKE phase 1).
ikeEncryption
required - stringThe IKE encryption algorithm (IKE phase 2).
ikeIntegrity
required - stringThe IKE integrity algorithm (IKE phase 2).
dhGroup
required - stringThe DH Group used in IKE Phase 1 for initial SA.
pfsGroup
required - stringThe Pfs Group used in IKE Phase 2 for new child SA.
radiusServerAddress
optional - stringThe radius server address property of the VpnServerConfiguration resource for point to site client connection.
radiusServerSecret
optional - stringThe radius secret property of the VpnServerConfiguration resource for point to site client connection.
radiusServers
optional arrayradiusServerAddress
required - stringThe address of this radius server.
radiusServerScore
optional - integerThe initial score assigned to this radius server.
radiusServerSecret
optional - stringThe secret used for this radius server.
aadAuthenticationParameters
optionalaadTenant
optional - stringAAD Vpn authentication parameter AAD tenant.
aadAudience
optional - stringAAD Vpn authentication parameter AAD audience.
aadIssuer
optional - stringAAD Vpn authentication parameter AAD issuer.
Frequently asked questions
What is Azure Network Server Configuration?
Azure Network Server Configuration is a resource for Network of Microsoft Azure. Settings can be wrote in Terraform.
Where can I find the example code for the Azure Network Server Configuration?
For Terraform, the tushar7653/testcaf, anmoltoppo/Terraform and davesee/terraform-caf-rover-breakout source code examples are useful. See the Terraform Example section for further details.
For Azure Resource Manager, the tmeadon/clippings, Lagler-Gruener/AzureTemplates and kloudexpedition/azure-quickstart-templates source code examples are useful. See the Azure Resource Manager Example section for further details.