Azure/Point-to-Site VPN - Revision history

Pio2pio: /* Routing */

2018-12-31T12:15:35Z

Routing

← Older revision		Revision as of 14:15, 31 December 2018
Line 450:		Line 450:

	== Routing ==		== Routing ==
			'''Allow gateway transit''' is only supported if both VNets are in the same region.

	When enabling '''Allow gateway transit''' via portal VPNConnection gets reset and needs to be brought up again. When activating tunnel up the new routes are advertised. It looks like IKEv2 protocol manages own 'virtual route table' that gets updated when needed. There is no need to use Custom Routes/and attach any route tables to subnets to enable traffic from VPNCliens over transit gateway in eg. VNet1 to any host in eg. VNet2. As long there is:		When enabling '''Allow gateway transit''' via portal VPNConnection gets reset and needs to be brought up again. When activating tunnel up the new routes are advertised. It looks like IKEv2 protocol manages own 'virtual route table' that gets updated when needed. There is no need to use Custom Routes/and attach any route tables to subnets to enable traffic from VPNCliens over transit gateway in eg. VNet1 to any host in eg. VNet2. As long there is:
	* peerlink between Vnet1 and VNet2		* peerlink between Vnet1 and VNet2

Pio2pio: /* P2S Transient VPN with peered Vnets */

2018-12-31T12:14:35Z

P2S Transient VPN with peered Vnets

← Older revision		Revision as of 14:14, 31 December 2018
Line 426:		Line 426:
	= Virtual Gateway - routing =		= Virtual Gateway - routing =
	== [https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered P2S Transient VPN with peered Vnets] ==		== [https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered P2S Transient VPN with peered Vnets] ==
			In this example, the Point-to-Site VPN gateway connection is for VNet1. VNet1 is peered with VNet2. VNet 2 is peered with VNet3. VNet1 is peered with VNet4. There is no direct peering between VNet1 and VNet3. VNet1 has “Allow gateway transit” and VNet2 has “Use remote gateways” enabled.
	<source>		<source>

Line 440:		Line 441:
	</source>		</source>

	In this example, the Point-to-Site VPN gateway connection is for VNet1. VNet1 is peered with VNet2. VNet 2 is peered with VNet3. VNet1 is peered with VNet4. There is no direct peering between VNet1 and VNet3. VNet1 has “Allow gateway transit” and VNet2 has “Use remote gateways” enabled.
	;Access		;Access
	*Windows - clients use SSTP or failback to IKEv2 VPN protocol if unable to connect		*Windows - clients use SSTP or failback to IKEv2 VPN protocol if unable to connect

Pio2pio: /* Routing */

2018-12-31T12:04:52Z

Routing

← Older revision		Revision as of 14:04, 31 December 2018
Line 449:		Line 449:

	== Routing ==		== Routing ==
	When enabling '''Allow gateway transit''' via portal VPNConnection ~~will be~~ reset and ~~new~~ needs to be ~~bring~~ up again. ~~With the bringing up~~ tunnel up new routes ~~will be~~ advertised.		When enabling '''Allow gateway transit''' via portal VPNConnection gets reset and needs to be brought up again. When activating tunnel up the new routes are advertised. It looks like IKEv2 protocol manages own 'virtual route table' that gets updated when needed. There is no need to use Custom Routes/and attach any route tables to subnets to enable traffic from VPNCliens over transit gateway in eg. VNet1 to any host in eg. VNet2. As long there is:
			* peerlink between Vnet1 and VNet2
			* VNet1 has 'Allow gateway transit' enabled
			* VNet2 has 'User remote gateway' enabled

			<source>
			Vnet4
			\|\| Linux host
			Vnet1 [peerlink: allow gateway transit] <----> IKEv2
			\|\| Strongswan
			Vnet2 [peerlink: use remote gw] 10.155.232.1/32 (received from
			\ tunnel)
			subnet: 10.155.24.0/24
			host: 10.155.24.4/32
			</source>


			Bring tunnel up and show the route policy
	<source lang=bash>		<source lang=bash>
	sudo ipsec up sandbox_infra_euw1 #bring tunnel up		sudo ipsec up sandbox_infra_euw1 #bring tunnel up
	sudo ip xfrm policy #show tunnel routing		sudo ip xfrm policy #show tunnel routing
	</source>		</source>


	{\| class="wikitable"		{\| class="wikitable"

Pio2pio: /* Routing */

2018-12-31T11:23:57Z

Routing

← Older revision		Revision as of 13:23, 31 December 2018
Line 570:		Line 570:
	</source>		</source>
	\|}		\|}

			[[File:P2s-xfrm-route-addition.png\|735px\|none\|left\|P2s-xfrm-route-addition]]

	= Resources =		= Resources =

Pio2pio: /* Routing */

2018-12-31T11:19:25Z

Routing

← Older revision		Revision as of 13:19, 31 December 2018
Line 449:		Line 449:

	== Routing ==		== Routing ==
			When enabling '''Allow gateway transit''' via portal VPNConnection will be reset and new needs to be bring up again. With the bringing up tunnel up new routes will be advertised.
			<source lang=bash>
			sudo ipsec up sandbox_infra_euw1 #bring tunnel up
			sudo ip xfrm policy #show tunnel routing
			</source>

			{\| class="wikitable"
			\|+ P2S Routing tables change on Linux clients when enabling 'gateway transit'
			\|-
			! Peering only
			! Allow gateway transit
			\|-
			\| style="vertical-align: top;" \| <source lang="bash">
			src 10.155.232.1/32 dst 10.155.232.0/25
			dir out priority 370815
			tmpl src 10.0.2.15 dst 23.99.111.222
			proto esp spi 0x3be13b36 reqid 2 mode tunnel
			src 10.155.232.0/25 dst 10.155.232.1/32
			dir fwd priority 370815
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 2 mode tunnel
			src 10.155.232.0/25 dst 10.155.232.1/32
			dir in priority 370815
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 2 mode tunnel
			#--> new route



			#--> new route



			#--> new route



			src 10.155.232.1/32 dst 10.155.2.0/23
			dir out priority 371839
			tmpl src 10.0.2.15 dst 23.99.111.222
			proto esp spi 0x3be13b36 reqid 2 mode tunnel
			src 10.155.2.0/23 dst 10.155.232.1/32
			dir fwd priority 371839
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 2 mode tunnel
			src 10.155.2.0/23 dst 10.155.232.1/32
			dir in priority 371839
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 2 mode tunnel
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket in priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket out priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket in priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket out priority 0
			src ::/0 dst ::/0
			socket in priority 0
			src ::/0 dst ::/0
			socket out priority 0
			src ::/0 dst ::/0
			socket in priority 0
			src ::/0 dst ::/0
			socket out priority 0
			</source>
			\| <source lang="bash">
			src 10.155.232.1/32 dst 10.155.232.0/25
			dir out priority 370815
			tmpl src 10.0.2.15 dst 23.99.111.222
			proto esp spi 0x93dcf3c2 reqid 4 mode tunnel
			src 10.155.232.0/25 dst 10.155.232.1/32
			dir fwd priority 370815
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 10.155.232.0/25 dst 10.155.232.1/32
			dir in priority 370815
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 10.155.232.1/32 dst 10.155.24.0/22
			dir out priority 372351
			tmpl src 10.0.2.15 dst 23.99.111.222
			proto esp spi 0x93dcf3c2 reqid 4 mode tunnel
			src 10.155.24.0/22 dst 10.155.232.1/32
			dir fwd priority 372351
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 10.155.24.0/22 dst 10.155.232.1/32
			dir in priority 372351
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 10.155.232.1/32 dst 10.155.2.0/23
			dir out priority 371839
			tmpl src 10.0.2.15 dst 23.99.111.222
			proto esp spi 0x93dcf3c2 reqid 4 mode tunnel
			src 10.155.2.0/23 dst 10.155.232.1/32
			dir fwd priority 371839
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 10.155.2.0/23 dst 10.155.232.1/32
			dir in priority 371839
			tmpl src 23.99.111.222 dst 10.0.2.15
			proto esp reqid 4 mode tunnel
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket in priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket out priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket in priority 0
			src 0.0.0.0/0 dst 0.0.0.0/0
			socket out priority 0
			src ::/0 dst ::/0
			socket in priority 0
			src ::/0 dst ::/0
			socket out priority 0
			src ::/0 dst ::/0
			socket in priority 0
			src ::/0 dst ::/0
			socket out priority 0
			</source>
			\|}

	= Resources =		= Resources =

Pio2pio: /* Virtual Gateway - P2S Transient VPN with peered Vnets - routing */

2018-12-31T10:47:07Z

Virtual Gateway - P2S Transient VPN with peered Vnets - routing

← Older revision		Revision as of 12:47, 31 December 2018
Line 424:		Line 424:
	Solution: This means client authentication has been skipped because the certificate was not found. One of a reasons is wrong password to .p12 file, also ipsec.secure should contan full file name eg client.p12, if the .p12 has no password double quotes "" should be used.		Solution: This means client authentication has been skipped because the certificate was not found. One of a reasons is wrong password to .p12 file, also ipsec.secure should contan full file name eg client.p12, if the .p12 has no password double quotes "" should be used.

	= Virtual Gateway - [https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered P2S Transient VPN with peered Vnets ~~- routing~~] =		= Virtual Gateway - routing =
			== [https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered P2S Transient VPN with peered Vnets] ==
	<source>		<source>

Pio2pio: /* Virtual Gateway - P2S Transient VPN with peered Vnets - routing */

2018-12-31T10:46:20Z

Virtual Gateway - P2S Transient VPN with peered Vnets - routing

← Older revision		Revision as of 12:46, 31 December 2018
Line 440:		Line 440:

	In this example, the Point-to-Site VPN gateway connection is for VNet1. VNet1 is peered with VNet2. VNet 2 is peered with VNet3. VNet1 is peered with VNet4. There is no direct peering between VNet1 and VNet3. VNet1 has “Allow gateway transit” and VNet2 has “Use remote gateways” enabled.		In this example, the Point-to-Site VPN gateway connection is for VNet1. VNet1 is peered with VNet2. VNet 2 is peered with VNet3. VNet1 is peered with VNet4. There is no direct peering between VNet1 and VNet3. VNet1 has “Allow gateway transit” and VNet2 has “Use remote gateways” enabled.
			;Access
	*Windows - clients use SSTP or failback to IKEv2 VPN protocol if unable to connect		*Windows - clients use SSTP or failback to IKEv2 VPN protocol if unable to connect
	**clients can access directly peered VNets, but the VPN client must be downloaded again if any changes are made to VNet peering or the network topology.		**clients can access directly peered VNets, but the VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

Pio2pio: /* Resources */

2018-12-31T10:45:26Z

Resources

← Older revision		Revision as of 12:45, 31 December 2018
Line 446:		Line 446:
	*Non-Windows - clients use IKEv2 protocol		*Non-Windows - clients use IKEv2 protocol
	**clients can access directly peered VNets. Access is not transitive and is limited to only directly peered VNets.		**clients can access directly peered VNets. Access is not transitive and is limited to only directly peered VNets.

			== Routing ==

	= Resources =		= Resources =

Pio2pio: /* Virtual Gateway - P2S Transient VPN with peered Vnets - routing */

2018-12-31T08:58:56Z

Virtual Gateway - P2S Transient VPN with peered Vnets - routing

@@ Line 424: / Line 424: @@
 Solution: This means client authentication has been skipped because the certificate was not found. One of a reasons is wrong password to .p12 file, also ipsec.secure should contan full file name eg client.p12, if the .p12 has no password double quotes "" should be used.
-= Virtual Gateway - P2S Transient VPN with peered Vnets - routing =
+= Virtual Gateway - [https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multipeered P2S Transient VPN with peered Vnets - routing] =
 = Resources =

Pio2pio: /* Resources */

2018-12-31T08:45:59Z

Resources

← Older revision		Revision as of 10:45, 31 December 2018
Line 423:		Line 423:

	Solution: This means client authentication has been skipped because the certificate was not found. One of a reasons is wrong password to .p12 file, also ipsec.secure should contan full file name eg client.p12, if the .p12 has no password double quotes "" should be used.		Solution: This means client authentication has been skipped because the certificate was not found. One of a reasons is wrong password to .p12 file, also ipsec.secure should contan full file name eg client.p12, if the .p12 has no password double quotes "" should be used.

			= Virtual Gateway - P2S Transient VPN with peered Vnets - routing =

	= Resources =		= Resources =