sample config for multiple site to site connections from RRAS server to azure would be great.

We're about to upgrade a Juniper SSG-320M appliance to screenos version 6.3.0R23.

I've noticed that all of the screenos config scripts to form a tunnel with an Azure VNET Gateway, reference version 6.2 of screenos for the Juniper SSG series.

Do you know if screenos 6.3.0R23 is supported for route-based VPN with Azure VNET Gateway?

I see the other one was closed, but i still need more information.
Lets take the example of 169.254.0.1. How do i test that the ipsec tunnel is working if i could actually use any ip address. Eg. what would i ping ?
If i had another tunnel on the same router, i couldnt use the same ip, are you saying i can pick any ip and it just works. In that case how do i verify it. Please dont just close the issue as more dialogue will follow. thanks.

Can updated examples be provided without the use of 3des?

References:

• http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf

In the Step_by_Step_guide_to_set_up_Site-to-Site_VPN_using_Cisco_ASA.docx document there is a mistake that caused me several days of troubleshooting.
The example azure virtual network "Azure_Virtual_NW" has an address space of 10.0.0.0/16, which has a subnet named "AzureVnet" in the example with address space of 10.0.0.0/24

Then in the Cisco ASA configuration portion, the object-group "azure-networks" is defined as the address range 10.0.0.0/24:

object-group network azure-networks
 description Azure-Virtual-Network
 network-object 10.0.0.0 255.255.255.0
  exit

This lead me to believe that the Azure-side advertises its address space as the subnet 10.0.0.0/24. However with this configuration you will get you phase II failures with "crypto map policy not found" errors on the ASA side, because the Azure side actually advertises its entire virtual network address space (10.0.0.0/16). As was discovered by seeing azure's "remote IP Proxy Subnet data Payload" in the ASA's log (public ip obfuscated):

7|Oct 14 2016|22:46:14|713035|||||Group = 13.X.X.X, IP = 13.X.X.X, Received remote IP Proxy Subnet data in ID Payload:   Address 10.0.0.0, Mask 255.255.0.0, Protocol 0, Port 0
7|Oct 14 2016|22:46:14|714011|||||Group = 13.X.X.X, IP = 13.X.X.X, ID_IPV4_ADDR_SUBNET ID received--10.0.0.0--255.255.0.0

In short, the object-group portion simply needs to be updated to be:

object-group network azure-networks
 description Azure-Virtual-Network
 network-object 10.0.0.0 255.255.0.0
  exit

IOS XE 15.4+ seems have some issues with 15.2 config example, it keeping create CHILD_SA every minute.

According to the following page, both RouteBased and PolicyBased for Juniper SRX is navigated to this page. Is the configuration same of both?
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices

It seems this page is for RouteBased. Does Juniper SRX support PolicyBased?

I was curious if anyone could help me convert the examples to normal Cisco IOS code? Microsoft is not interested in assisting.

Thank you in advance for your help.

I need to access VM from App service, but both are in different region,

Is it possible

Anyone from Microsoft still reading the issues in this repo?

If i submit a StrongSwan IKEv2 template, is that something that could be considered for merging and ultimately showing up in the Azure Portal?

I've also noticed the only template now showing is "Microsoft":

Is the template feature being discontinued or is this just a temporary glitch?

Thank you.

ipsec stroke up safaricom_vpn
initiating Main Mode IKE_SA safaricom_vpn[1] to xx.xx.xx.xx
generating ID_PROT request 0 [ SA V V V V ]
sending packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (216 bytes)
received packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (120 bytes)
parsed ID_PROT response 0 [ SA V V ]
received NAT-T (RFC 3947) vendor ID
received FRAGMENTATION vendor ID
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (308 bytes)
received packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (368 bytes)
parsed ID_PROT response 0 [ KE No V V V V NAT-D NAT-D ]
received Cisco Unity vendor ID
received XAuth vendor ID
received unknown vendor ID: c9:b2:a2:af:4a:88:74:f0:92:c2:b1:32:ae:3e:da:a9
received unknown vendor ID: 1f:07:f7:0e:aa:65:14:d3:b0:fa:96:54:2a:50:01:00
generating ID_PROT request 0 [ ID HASH ]
sending packet: from yy.yy.yy.yy[500] to xx.xx.xx.xx[500] (76 bytes)
received packet: from xx.xx.xx.xx[500] to yy.yy.yy.yy[500] (40 bytes)
parsed INFORMATIONAL_V1 request 0 [ N(PLD_MAL) ]
ignoring unprotected INFORMATIONAL from xx.xx.xx.xx
message verification failed
ignore malformed INFORMATIONAL request
INFORMATIONAL_V1 request with message ID 0 processing failed
sending retransmit 1 of request message ID 0, seq 3

KIndly someone help on what cud be the issue

Do we really need UTF-16 here?

https://github.com/Azure/Azure-vpn-config-samples/blob/master/Cisco/cisco-isr-ios-15.1-dynamic-routing.cfg#L1

<?xml version="1.0" encoding="utf-16"?>

Forces git to treat .cfg files as binary.

cisco-asr-ios-15.2-Route_Based.txt contains no bgp configurations.

According to https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell and more specific to https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#ipsec the IKE Phase1 and Phase2 SA Lifetime looks wrong to me.

In the current https://github.com/Azure/Azure-vpn-config-samples/blob/master/Fortinet/Current/Site-to-Site_VPN_using_FortiGate.md the values 10800 and 3600 are used, the official documentation for route based VPNs lists 28800s for the phase1 and 27000 for the pase2.

Hello,
i seen in the example that the tunnel interface was 169.254.0.1 255.255.255.0, please can you confirm that this is just an example and the actual ip address allocated is different.
I would need to know what to target the far end in order to test the ipsec tunnel works.
thanks.

There are important files that Microsoft projects should all have that are not present in this repository. A pull request has been opened to add the missing file(s). When the pr is merged this issue will be closed automatically.

Microsoft teams can learn more about this effort and share feedback within the open source guidance available internally.

Merge this pull request

Hi there,
Apologies if this is me being very stupid, I have googled but how on earth do I use
the RRAS 2012r2 .ps1.xslt file to configure the gateway ?