VPN to Azure Virtual Network from On-prem Router – Part 1

I set out to implement a VPN tunnel from my on-prem network to my Azure subscription virtual network.  There are several good Microsoft Documentation articles for configuring the Azure side but here I will provide some additional information for configuration of the on-prem router as well.  I am using a Ubiquiti EdgeRouter X-SFP for my on-prem router which offers flexibility for a good price.

Below is the table of values used to correlate to the commands ran below:

Value Name Updated Values Default Values from MS Documentation Article
VnetName SLAzurevnet (TestVNet1)
ResourceGroup sl_azure_rg (TestRG1)
Location East US 2 (East US)
AddressSpace (
SubnetName sl_azure_subnet1 (Subnet1)
Subnet (
GatewaySubnet (
LocalNetworkGatewayName sl_onprem (Site2)
LNG Public IP onprempublicip (<VPN device IP address>)
Local Address Prefixes (,
Gateway Name slazuregateway (VNet1GW)
PublicIP slazuregatewayip (VNet1GWIP)
Gateway IP Config gwipconfig1 (gwipconfig1)
VPNType RouteBased (RouteBased)
GatewayType Vpn (Vpn)
ConnectionName slazuretoslonprem (VNet1toSite2)

Below is the configuration ran from the PowerShell console in the Azure RM Portal:

2. Create a virtual network and a gateway subnet

#Create resource group
New-AzureRmResourceGroup -Name sl_azure_rg -Location ‘East US 2’

##To create a virtual network and a gateway subnet
$subnet1 = New-AzureRmVirtualNetworkSubnetConfig -Name ‘GatewaySubnet’ -AddressPrefix
$subnet2 = New-AzureRmVirtualNetworkSubnetConfig -Name ‘Subnet1’ -AddressPrefix
New-AzureRmVirtualNetwork -Name SLAzurevnet -ResourceGroupName sl_azure_rg -Location ‘East US 2’ -AddressPrefix -Subnet $subnet1, $subnet2

##To add a gateway subnet to a virtual network you have already created
$vnet = Get-AzureRmVirtualNetwork -ResourceGroupName sl_azure_rg -Name SLAzurevnet
Add-AzureRmVirtualNetworkSubnetConfig -Name ‘GatewaySubnet’ -AddressPrefix -VirtualNetwork $vnet
Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

3. Create the local network gateway
New-AzureRmLocalNetworkGateway -Name sl_onprem -ResourceGroupName sl_azure_rg -Location ‘East US 2’ -GatewayIpAddress ‘onprempublicip’ -AddressPrefix ‘’

4. Request a Public IP address
$gwpip= New-AzureRmPublicIpAddress -Name gwpip -ResourceGroupName sl_azure_rg -Location ‘East US 2’ -AllocationMethod Dynamic

5. Create the gateway IP addressing configuration
$vnet = Get-AzureRmVirtualNetwork -Name SLAzurevnet -ResourceGroupName sl_azure_rg
$subnet = Get-AzureRmVirtualNetworkSubnetConfig -Name ‘GatewaySubnet’ -VirtualNetwork $vnet
$gwipconfig = New-AzureRmVirtualNetworkGatewayIpConfig -Name gwipconfig1 -SubnetId $subnet.Id -PublicIpAddressId $gwpip.Id

6. Create the VPN gateway
New-AzureRmVirtualNetworkGateway -Name slazuregateway -ResourceGroupName sl_azure_rg -Location ‘East US 2’ -IpConfigurations $gwipconfig -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1

7. Configure your VPN device (Read part 2 for my Ubiquiti Router setup)
Get-AzureRmPublicIpAddress -Name gwpip -ResourceGroupName sl_azure_rg

8. Create the VPN connection
$gateway1 = Get-AzureRmVirtualNetworkGateway -Name slazuregateway -ResourceGroupName sl_azure_rg
$local = Get-AzureRmLocalNetworkGateway -Name sl_onprem -ResourceGroupName sl_azure_rg
New-AzureRmVirtualNetworkGatewayConnection -Name slazuretoslonprem -ResourceGroupName sl_azure_rg -Location ‘East US 2’ -VirtualNetworkGateway1 $gateway1 -LocalNetworkGateway2 $local -ConnectionType IPsec -RoutingWeight 10 -SharedKey ‘supersecretpw’

9. Verify the VPN connection
Get-AzureRmVirtualNetworkGatewayConnection -Name slazuretoslonprem -ResourceGroupName sl_azure_rg


Please continue to the next part of this topic to configure the on-prem router.

Thanks for reading,

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.