**Microsoft Azure**

This article describes how to establish a Site-To-Site IPSec VPN connection between your Azure server and Privatise network. Please follow the steps below:

**Creating a Gateway Subnet**

1. In your Azure Management Portal, navigate to the Virtual networks.

{{:3600046574201.png?nolink&200|}}

2. Select the name of the Virtual Network to which you'd like to create a gateway.

3. Under the Settings section of your VNet page, select Subnets.

{{::360004718639image27.png?nolink&200|}}

4. Select + Gateway subnet (the name of the subnet is filled in with the value "Gateway subnet" by default).

{{::360004658980image19.png?nolink&200|}}

5. If needed, adjust the auto-filled Address range values to match your configuration requirements. 

**In case this range is not automatically filled in:**

  * Go to address space-> +Add
  * Select a random /27 bit mask subnet space (for example 10.1.255.0/27)

{{::httpsfilesreadmeiofa450d0-screenshot2019-05-30at83915.png?nolink&200|}}

**Creating a Virtual Network Gateway**

1. On the left side of the portal page, select + and type Virtual Network Gateway in the Search line.

{{::360004659680image5.png?nolink&200|}}

2. Locate and select the **Virtual network gateway**.

{{::360004659820image15.png?nolink&200|}}

3. Select Create.

{{::360004660040image13.png?nolink&200|}}

4. Fill in the fields with the following information:

**Name: Your gateway name.**

**Region/Location:** Select the Virtual Network location\region where your resources are.

**Gateway type:** Select VPN.

**VPN type:** Select **Route-based**.

**SKU:** Select the gateway SKU from the dropdown. The SKUs listed in the dropdown depend on the VPN you select.

{{::360004661220image3.png?nolink&200|}}

**Virtual network:** 

Select the Virtual network that contains the resources you want to reach via the tunnel.

Select a **Virtual network** to open the **Choose a virtual network** page.

If you don't see your VNet, make sure the **Location/Region** field is pointing to the region in which your virtual network is located.

{{::360004661600image141.png?nolink&200|}}

**Gateway subnet address range:** You will only see this setting if you did not previously create a gateway subnet for your virtual network. If you previously created a valid gateway subnet, this field will not appear.

**Public IP address:** This specifies the public IP address object that's associated with the VPN gateway. The public IP address is dynamically assigned to this object when the VPN gateway is created.

**Enable active-active mode:** Disabled.

**Configure BGP ASN:** Disabled.

Select **Review+create** to begin creating the VPN gateway.

It can take up to 45 minutes for the task to be completed.

{{::360004723239image24.png?nolink&200|}}

**Creating a Local Network Gateway**

1. In the portal, select **+ Create a resource.**

{{:360004661860image5.png?nolink&200|}}

2. In the search box type "Local network gateway".

{{::360004708580image10.png?nolink&200|}}

3. Select **Local network gateway**, then select **Create** to open the Create local network gateway page.

{{::360004770199image28.png?nolink&200|}}

4. Fill in the fields with the following information:

**Name** Your gateway name.

**IP address:** This is the public IP address of the VPN device that you want Azure to connect to. Specify your Privatise gateway IP, found next to Static IP under "Roc on Demand" in the Managed Company Portal.

**Address Space:** Insert your Privatise subnet provided to you by support. (make sure that the ranges you specify here do not overlap with ranges of other networks that you want to connect to).

**Subscription:** Verify that the correct subscription is showing.

**Resource Group:** Select the resource group that you want to use. You can either create a new resource group or select one that you have already created.

**Location:** Select a location that this object will be created in.

You may want to select the location in which your Virtual Network resides, however it is not a requirement.

**SKU:** Select the gateway SKU from the dropdown. The SKUs listed in the dropdown depend on the VPN you select.

5. Select **Create** at the bottom of the page to create the local network gateway.

{{::360009520980e1a7202-screenshot-newip.jpg?nolink&200|}}

**Creating the IPSEC tunnel connection**

1. Open your virtual network gateway page.

2. On the sidebar, select **All resources**.

{{::360004709660image18.png?nolink&200|}}

3. Select the **Virtual network gateway** you created. Once it opens, go to **Settings**, select Connections, and then **+Add**.

{{::360004770719image8.png?nolink&200|}}

4. Fill in the fields with the following information:

**Name** Your connection name.

**Connection type:** Select Site-to-site (IPSec).

**Virtual network gateway:** Since you are connecting from this gateway this value (the IP you received from Azure) is fixed.

**Local network gateway:** The local network gateway (your Privatise address) which you have just created is the fixed value.

**Shared Key:** This will be provided to you by our support team.

The remaining values for **Subscription**, **Resource Group**, and **Location** are fixed as well.

Select **OK** to create your connection.

{{::httpsfilesreadmeiob6405e8-screenshot2019-05-30at84806.png?nolink&200|}}

**Verifying the VPN connection**

1. Go to the Azure Portal and select All Resources.

{{::360004711420image2.png?nolink&200|}}

2. Select the Virtual network gateway.

{{::360004711440image20.png?nolink&200|}}

3. Go to Connections.

4. Select the connection you created.

{{::360004771499image25.png?nolink&200|}}

5. Under the Overview tab, make sure that the Status is Connected.

{{::360004711480image16.png?nolink&200|}}