Create a site-to-site connection to Azure Virtual WAN using PowerShell

Article
06/15/2023

This article shows you how to use Virtual WAN to connect to your resources in Azure over an IPsec/IKE (IKEv1 and IKEv2) VPN connection via PowerShell. This type of connection requires a VPN device located on-premises that has an externally facing public IP address assigned to it. For more information about Virtual WAN, see the Virtual WAN overview. You can also create this configuration using the Azure portal instructions.

Prerequisites

Verify that you have an Azure subscription. If you don't already have an Azure subscription, you can activate your MSDN subscriber benefits or sign up for a free account.
Decide the IP address range that you want to use for your virtual hub private address space. This information is used when configuring your virtual hub. A virtual hub is a virtual network that is created and used by Virtual WAN. It's the core of your Virtual WAN network in a region. The address space range must conform to certain rules.
- The address range that you specify for the hub can't overlap with any of the existing virtual networks that you connect to.
- The address range can't overlap with the on-premises address ranges that you connect to.
- If you're unfamiliar with the IP address ranges located in your on-premises network configuration, coordinate with someone who can provide those details for you.

Azure PowerShell

This article uses PowerShell cmdlets. To run the cmdlets, you can use Azure Cloud Shell. Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.

To open Cloud Shell, just select Open Cloudshell from the upper-right corner of a code block. You can also open Cloud Shell on a separate browser tab by going to https://shell.azure.com/powershell. Select Copy to copy the blocks of code, paste them into Cloud Shell, and select the Enter key to run them.

You can also install and run the Azure PowerShell cmdlets locally on your computer. PowerShell cmdlets are updated frequently. If you haven't installed the latest version, the values specified in the instructions may fail. To find the versions of Azure PowerShell installed on your computer, use the Get-Module -ListAvailable Az cmdlet. To install or update, see Install the Azure PowerShell module.

If you're using Azure Cloud Shell you'll automatically be directed to sign into your account after you open Cloudshell. You don't need to run Connect-AzAccount. Once signed in, you can still change subscriptions if necessary by using Get-AzSubscription and Select-AzSubscription.

If you're running PowerShell locally, open the PowerShell console with elevated privileges and connect to your Azure account. The Connect-AzAccount cmdlet prompts you for credentials. After you authenticate, it downloads your account settings so that they're available to Azure PowerShell. You can change subscription by using Get-AzSubscription and Select-AzSubscription -SubscriptionName "Name of subscription".

Create a virtual WAN

Before you can create a virtual wan, you have to create a resource group to host the virtual wan or use an existing resource group. Use one of the following examples.

This example creates a new resource group named TestRG in the East US location. If you want to use an existing resource group instead, you can modify the $resourceGroup = Get-AzResourceGroup -ResourceGroupName "NameofResourceGroup" command, and then complete the steps in this exercise using your own values.

Create a resource group.

New-AzResourceGroup -Location "East US" -Name "TestRG"

Create the virtual wan using the New-AzVirtualWan cmdlet.

$virtualWan = New-AzVirtualWan -ResourceGroupName TestRG -Name TestVWAN1 -Location "East US"

Create the hub and configure hub settings

A hub is a virtual network that can contain gateways for site-to-site, ExpressRoute, or point-to-site functionality. Create a virtual hub with New-AzVirtualHub. This example creates a default virtual hub named Hub1 with the specified address prefix and a location for the hub.

$virtualHub = New-AzVirtualHub -VirtualWan $virtualWan -ResourceGroupName "TestRG" -Name "Hub1" -AddressPrefix "10.1.0.0/16" -Location "westus"

Create a site-to-site VPN gateway

In this section, you create a site-to-site VPN gateway in the same location as the referenced virtual hub. When you create the VPN gateway, you specify the scale units that you want. It takes about 30 minutes for the gateway to create.

If you closed Azure Cloud Shell or your connection timed out, you may need to declare the variable again for $virtualHub.
```
$virtualHub = Get-AzVirtualHub -ResourceGroupName "TestRG" -Name "Hub1"
```

Create a VPN gateway using the New-AzVpnGateway cmdlet.

New-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1" -VirtualHubId $virtualHub.Id -VpnGatewayScaleUnit 2

Once your VPN gateway is created, you can view it using the following example.
```
Get-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1"
```

Create a site and connections

In this section, you create sites that correspond to your physical locations and the connections. These sites contain your on-premises VPN device endpoints, you can create up to 1000 sites per virtual hub in a virtual WAN. If you have multiple hubs, you can create 1000 per each of those hubs.

Set the variable for the VPN gateway and for the IP address space that is located on your on-premises site. Traffic destined for this address space is routed to your local site. This is required when BGP isn't enabled for the site.
```
$vpnGateway = Get-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1"
$vpnSiteAddressSpaces = New-Object string[] 2
$vpnSiteAddressSpaces[0] = "192.168.2.0/24"
$vpnSiteAddressSpaces[1] = "192.168.3.0/24"
```

Create links to add information about the physical links at the branch including metadata about the link speed, link provider name, and the public IP address of the on-premises device.

$vpnSiteLink1 = New-AzVpnSiteLink -Name "TestSite1Link1" -IpAddress "15.25.35.45" -LinkProviderName "SomeTelecomProvider" -LinkSpeedInMbps "10"
$vpnSiteLink2 = New-AzVpnSiteLink -Name "TestSite1Link2" -IpAddress "15.25.35.55" -LinkProviderName "SomeTelecomProvider2" -LinkSpeedInMbps "100"

Create the VPN site, referencing the variables of the VPN site links you just created.

If you closed Azure Cloud Shell or your connection timed out, redeclare the virtual WAN variable:

$virtualWan = Get-AzVirtualWAN -ResourceGroupName "TestRG" -Name "TestVWAN1"

Create the VPN site using the New-AzVpnSite cmdlet.

$vpnSite = New-AzVpnSite -ResourceGroupName "TestRG" -Name "TestSite1" -Location "westus" -VirtualWan $virtualWan -AddressSpace $vpnSiteAddressSpaces -DeviceModel "SomeDevice" -DeviceVendor "SomeDeviceVendor" -VpnSiteLink @($vpnSiteLink1, $vpnSiteLink2)

Create the site link connection. The connection is composed of two active-active tunnels from a branch/site to the scalable gateway.

$vpnSiteLinkConnection1 = New-AzVpnSiteLinkConnection -Name "TestLinkConnection1" -VpnSiteLink $vpnSite.VpnSiteLinks[0] -ConnectionBandwidth 100
$vpnSiteLinkConnection2 = New-AzVpnSiteLinkConnection -Name "testLinkConnection2" -VpnSiteLink $vpnSite.VpnSiteLinks[1] -ConnectionBandwidth 10

Connect the VPN site to a hub

Connect your VPN site to the hub site-to-site VPN gateway using the New-AzVpnConnection cmdlet.

Before running the command, you may need to redeclare the following variables:

$virtualWan = Get-AzVirtualWAN -ResourceGroupName "TestRG" -Name "TestVWAN1"
$vpnGateway = Get-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1"
$vpnSite = Get-AzVpnSite -ResourceGroupName "TestRG" -Name "TestSite1"

Connect the VPN site to the hub.

New-AzVpnConnection -ResourceGroupName $vpnGateway.ResourceGroupName -ParentResourceName $vpnGateway.Name -Name "testConnection" -VpnSite $vpnSite -VpnSiteLinkConnection @($vpnSiteLinkConnection1, $vpnSiteLinkConnection2)

Connect a VNet to your hub

The next step is to connect the hub to the VNet. If you created a new resource group for this exercise, you typically won't already have a virtual network (VNet) in your resource group. The steps below help you create a VNet if you don't already have one. You can then create a connection between the hub and your VNet.

Create a virtual network

You can use the following example values to create a VNet. Make sure to substitute the values in the examples for the values you used for your environment. For more information, see Quickstart: Use Azure PowerShell to create a virtual network.

Create a VNet.

$vnet = @{
   Name = 'VNet1'
   ResourceGroupName = 'TestRG'
   Location = 'eastus'
   AddressPrefix = '10.21.0.0/16'
}
$virtualNetwork = New-AzVirtualNetwork @vnet

Specify subnet settings.

$subnet = @{
   Name = 'Subnet-1'
   VirtualNetwork = $virtualNetwork
   AddressPrefix = '10.21.0.0/24'
}
$subnetConfig = Add-AzVirtualNetworkSubnetConfig @subnet

Set the VNet.
```
$virtualNetwork | Set-AzVirtualNetwork
```

Connect a VNet to a hub

Once you have a VNet, follow the steps in this article to connect your VNet to the VWAN hub: Connect a VNet to a Virtual WAN hub.

Configure VPN device

To configure your on-premises VPN device, follow the steps in the Site-to-site: Azure portal article.

Clean up resources

When you no longer need the resources that you created, delete them. Some of the Virtual WAN resources must be deleted in a certain order due to dependencies. Deleting can take about 30 minutes to complete.

Delete all gateway entities in the following order:

Declare the variables.

$resourceGroup = Get-AzResourceGroup -ResourceGroupName "TestRG" 
$virtualWan = Get-AzVirtualWan -ResourceGroupName "TestRG" -Name "TestVWAN1"
$virtualHub = Get-AzVirtualHub -ResourceGroupName "TestRG" -Name "Hub1"
$vpnGateway = Get-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1"

Delete the VPN gateway connection to the VPN sites.

Remove-AzVpnConnection -ResourceGroupName $vpnGateway.ResourceGroupName -ParentResourceName $vpnGateway.Name -Name "testConnection"

Delete the VPN gateway. Deleting a VPN gateway will also remove all VPN ExpressRoute connections associated with it.
```
Remove-AzVpnGateway -ResourceGroupName "TestRG" -Name "vpngw1"
```
At this point, you can do one of two things:
- You can delete the entire resource group in order to delete all the remaining resources it contains, including the hubs, sites, and the virtual WAN.
- You can choose to delete each of the resources in the resource group.
To delete the entire resource group:
```
Remove-AzResourceGroup -Name "TestRG"
```
To delete each resource in the resource group:
- Delete the VPN site.
```
Remove-AzVpnSite -ResourceGroupName "TestRG" -Name "TestSite1"
```
- Delete the virtual hub.
```
Remove-AzVirtualHub -ResourceGroupName "TestRG" -Name "Hub1"
```
- Delete the virtual WAN.
```
Remove-AzVirtualWan -Name "TestVWAN1" -ResourceGroupName "TestRG"
```

Next steps

Next, to learn more about Virtual WAN, see the Virtual WAN FAQ.

Create a site-to-site connection to Azure Virtual WAN using PowerShell

Prerequisites

Azure PowerShell

Create a virtual WAN

Create the hub and configure hub settings

Create a site-to-site VPN gateway

Create a site and connections

Connect the VPN site to a hub

Connect a VNet to your hub

Create a virtual network

Connect a VNet to a hub

Configure VPN device

Clean up resources

Next steps

Feedback

Additional resources

Create a site-to-site connection to Azure Virtual WAN using PowerShell

Prerequisites

Azure PowerShell

Sign in

Create a virtual WAN

Create the hub and configure hub settings

Create a site-to-site VPN gateway

Create a site and connections

Connect the VPN site to a hub

Connect a VNet to your hub

Create a virtual network

Connect a VNet to a hub

Configure VPN device

Clean up resources

Next steps

Feedback

Additional resources