Configuration Procedure

Transcription

1 How to Establish Site-to-Site VPN between USG and MS Azure

2 Background Microsoft (MS) Azure is an open and flexible cloud platform that enables users to quickly build, deploy, scale and manage applications across a global network of MS datacenters. ZyWALLs/USGs support static routing VPN (i.e., Policy-based VPN) to an MS Azure virtual network. Administrators can easily create a secure IP connection between MS Azure services and the on-site IT network.

3 Configuration Procedure Task 1. Create a Virtual Network on MS Azure Step 1. Sign into the Windows Azure Management Portal In the lower left-hand corner of the screen, click New. Step 2. In the navigation pane, click Network Services > Virtual Network. Click Custom Create to begin the configuration wizard. Step 3. On the Virtual Network Details page, enter the required information. Then click the Next button located at the lower right-hand corner of the screen to go to the next page. Name Create a name for the virtual network. For example, EastASVNet Location The location is directly related to the physical location (region) where the resources (VMs) reside. For example, the user wants the VMs deployed on this virtual network to be physically located in East Asia. Therefore, that location (East Asia) should be selected. The region associated with the virtual network cannot be changed after it has been created

4 Step 4. On the DNS Servers and VPN Connectivity page, enter the following information, and click the Next button. Configure Site-to-Site VPN Select the checkbox for Configure a site-to-site VPN Local Network A local network represents the physical on-site location. Users can select a local network that has been previously created, or create a New Local Network

5 Step 5. If creating a new local network, users are directed to the Site-to-Site Connectivity page. Enter the following information, and click the Next button. Name The name for the local (on-site) network behind the ZyWALL/USG VPN Device IP Address This is the public IPv4 address of the ZyWALL/USG WAN interface. The ZyWALL/USG cannot be located behind a NAT Address Space includes Starting IP and CIDR (Address Count). This indicates the address range(s) of the network behind the ZyWALL/USG Step 6. On the Virtual Network Address Spaces page, specify the address range of the Windows Azure virtual network. Enter the following information, and then click the checkmark on the lower right section of the screen to apply the configuration. Address Space includes the Starting IP and CIDR (Address Count). This indicates the address range(s) of the Windows Azure virtual network Note: The Windows Azure virtual network address space and the network behind the ZyWALL/USG should not overlap Add gateway subnet Click this to add a gateway subnet. The gateway subnet is used only for the virtual network gateway and is required for this configuration

6 Step 7. When the configuration has been completed, users can see the text Created under Status on the Networks page of the management portal.

7 Task 2. Create a Virtual Network Gateway on MS Azure Step 1. On the Networks page, click the name of the virtual network. Step 2. On the Dashboard page, at the bottom of the screen, click Create Gateway. Then select Static Routing.

8 Step 3. When the system prompts for confirmation that the user wants a gateway created, click Yes. While the gateway is being created, notice that the gateway graphic on the page changes to yellow, and the status indicator says Creating Gateway. The creation of the gateway may take up to 15 minutes. Users have to wait until the process is completed before moving forward and configuring other settings. After the gateway has been created, users can get the public IPv4 address of the VPN gateway for the Windows Azure virtual network. This is the peer gateway address needed for configuring the IPSec VPN Gateway rule on the ZyWALL/USG.

9

10 Task 3. Create an Address object for the VPN on USG Step 1. Go to CONFIGURATION > Object > Address, and create an address object named NET192_168 Step 2. Go to CONFIGURATION > Object > Address, and create an address object named Azure_VNET

11 Task 4. Create IPSec Site-to-Site VPN Step 1. Go to CONFIGURATION > VPN > IPSec VPN > VPN Gateway, and create a VPN Gateway. Phase 1 IKE version: IKEv1 Proposal: AES256-SHA1 Key Group: DH2 SA Life Time: Disable DPD Pre-Shared Key: This is auto-generated by MS Azure. Copy it from the Windows Azure Virtual Network dashboard, under Manage Key.

12 Step 2. Go to CONFIGURATION > VPN > IPSec VPN > VPN Connection, and create a VPN Connection. Phase 2 MSS: 1350 Bytes Encapsulation: Tunnel Active Protocol / Proposal: ESP / AES128-SHA1 SA Life Time: 3600

13 Enable Connectivity Check on one of the VM instances in MS Azure as seen above. When there is no traffic between peers, MS Azure sends an SA DEL message (to disconnect the VPN) every 5 minutes. Task 5. Check VPN connection

14 On MS Azure Go to Networks > EastASVNET > Dashboard. The connection is up. On USG Go to Monitor > VPN Monitor > IPSec. The tunnel is in the list.