Microsoft has given us the ability to define custom IKE/IPsec policies for use with the native Virtual Network Gateway. In the past, the on-premise peer device had to support the fairly limited protocols suites that were statically set on the Virtual Network Gateway.
It should be noted that custom IKE/IPsec policies are set at connection object level and not on the Virtual Network Gateway itself, this offers greater flexibility when you have multi-site VPN connections terminated on a single Virtual Network Gateway. This example covers how to create a custom policy for an S2S VPN connection, it is also possible to apply custom policies to vNet to vNet connection. Although this may not be as commonly done after vNet Peering becoming GA.
Please note that in this example the Virtual Network Gateway along with the Local Network Gateway has already been defined in my subscription. The Local Network Gateway is the resource that contains the remote VPN peer address etc.
This command creates the new policy and stores it in a variable called $policy, this will be referenced when we are creating the new connection object.
|
$policy = New-AzureRmIpsecPolicy -DhGroup ECP384 -IkeEncryption AES256 -IkeIntegrity SHA384 -IpsecEncryption GCMAES256 -IpsecIntegrity GCMAES256 -PfsGroup
|
This command stores the Virtual Network Gateway you want to create the connection object on and stores it in a variable called $gateway.
|
$gateway = Get-AzureRmVirtualNetworkGateway -Name "rbVNG01" -ResourceGroupName "rbRG1"
|
This command stores the Local Network Gateway object in the variable $remote
|
$remote = Get-AzureRmLocalNetworkGateway -Name "TW-2-AZ" -ResourceGroupName "rbRG1"
|
This command creates the connection object and applies the newly created policy.
|
New-AzureRmVirtualNetworkGatewayConnection -Name "TW-2-AZ" -ResourceGroupName
"rbRG1" -VirtualNetworkGateway1
$gateway -LocalNetworkGateway2
$remote -Location
"UK South" -ConnectionType IPsec
-IpsecPolicies $policy
-SharedKey "VerySecretCode"
|
Please review this article for full details on the supported protocol suites etc.
