Create a VNet with a Site-to-Site connection using the Azure portal

This article walks you through creating a virtual network and a Site-to-Site VPN gateway connection to your on-premises network using the Azure Resource Manager deployment model and the Azure portal. Site-to-Site connections can be used for cross-premises and hybrid configurations.

Site-to-Site VPN Gateway cross-premises connection diagram

Deployment models and methods for Site-to-Site connections

It's important to understand that Azure currently works with two deployment models: Resource Manager and classic. Before you begin your configuration, verify that you are using the instructions for the deployment model that you want to work in. For example, if you are working with a virtual network that was created using the classic deployment model and want to add a connection to the VNet, you would use the deployment methods that correspond to the classic deployment model, not Resource Manager. See Understanding deployment models for more information.

The following table shows the currently available deployment models and methods for Site-to-Site configurations. When an article with configuration steps is available, we link directly to it from this table.

Deployment Model/Method Azure Portal Classic Portal PowerShell
Resource Manager Article Not Supported Article
Classic Article** Article* Article+

(*) denotes that the classic portal can only support creating one S2S VPN connection.

(**) denotes that this method contains steps that require PowerShell.

(+) denotes that this article is written for multi-site connections.

Additional configurations

If you want to connect VNets together, but are not creating a connection to an on-premises location, see Configure a VNet-to-VNet connection. If you want to add a Site-to-Site connection to a VNet that already has a connection, see Add a S2S connection to a VNet with an existing VPN gateway connection.

Before you begin

Verify that you have the following items before beginning your configuration:

  • A compatible VPN device and someone who is able to configure it. See About VPN Devices. If you aren't familiar with configuring your VPN device, or are unfamiliar with the IP address ranges located in your on-premises network configuration, you need to coordinate with someone who can provide those details for you.
  • An externally facing public IP address for your VPN device. This IP address cannot be located behind a NAT.
  • An Azure subscription. If you don't already have an Azure subscription, you can activate your MSDN subscriber benefits or sign up for a free account.

Sample configuration values for this exercise

When using these steps as an exercise, you can use the sample configuration values:

  • VNet Name: TestVNet1
  • Address Space: and
  • Subnets:
    • FrontEnd:
    • BackEnd:
    • GatewaySubnet:
  • Resource Group: TestRG1
  • Location: East US
  • DNS Server:
  • Gateway Name: VNet1GW
  • Public IP: VNet1GWIP
  • VPN Type: Route-based
  • Connection Type: Site-to-site (IPsec)
  • Gateway Type: VPN
  • Local Network Gateway Name: Site2
  • Connection Name: VNet1toSite2

1. Create a virtual network

If you already have a VNet, verify that the settings are compatible with your VPN gateway design. Pay particular attention to any subnets that may overlap with other networks. If you have overlapping subnets, your connection won't work properly. If your VNet is configured with the correct settings, you can begin the steps in the Specify a DNS server section.

To create a virtual network

To create a VNet in the Resource Manager deployment model by using the Azure portal, follow the steps below. The screenshots are provided as examples. Be sure to replace the values with your own. For more information about working with virtual networks, see the Virtual Network Overview.

  1. From a browser, navigate to the Azure portal and, if necessary, sign in with your Azure account.
  2. Click New. In the Search the marketplace field, type "Virtual Network". Locate Virtual Network from the returned list and click to open the Virtual Network blade.

    Locate Virtual Network resource blade

  3. Near the bottom of the Virtual Network blade, from the Select a deployment model list, select Resource Manager, and then click Create.

    Select Resource Manager

  4. On the Create virtual network blade, configure the VNet settings. When you fill in the fields, the red exclamation mark will become a green check mark when the characters entered in the field are valid.

    Field validation

  5. The Create virtual network blade looks similar to the following example. There may be values that are auto-filled. If so, replace the values with your own.

    Create virtual network blade

  6. Name: Enter the name for your Virtual Network.
  7. Address space: Enter the address space. If you have multiple address spaces to add, add your first address space. You can add additional address spaces later, after creating the VNet.
  8. Subnet name: Add the subnet name and subnet address range. You can add additional subnets later, after creating the VNet.
  9. Subscription: Verify that the Subscription listed is the correct one. You can change subscriptions by using the drop-down.
  10. Resource group: Select an existing resource group, or create a new one by typing a name for your new resource group. If you are creating a new group, name the resource group according to your planned configuration values. For more information about resource groups, visit Azure Resource Manager Overview.
  11. Location: Select the location for your VNet. The location determines where the resources that you deploy to this VNet will reside.
  12. Select Pin to dashboard if you want to be able to find your VNet easily on the dashboard, and then click Create.

    Pin to dashboard

  13. After clicking Create, you will see a tile on your dashboard that will reflect the progress of your VNet. The tile changes as the VNet is being created.

    Creating virtual network tile

2. Add additional address space and subnets

You can add additional address space and subnets to your VNet once it has been created.

To add address space

  1. To add additional address space, under the Settings section for your virtual network blade, click Address space to open the Address space blade.
  2. Add the additional address space, and then click Save at the top of the blade.

    Add address space

To create subnets

  1. To create subnets, in the Settings section of your virtual network blade, click Subnets to open the Subnets blade.
  2. In the Subnets blade, click +Subnet to open the Add subnet blade. Name your new subnet and specify the address range.

    Subnet settings

  3. Click OK at the bottom of the blade to save your changes.

    Subnet settings

3. Specify a DNS server

To specify a DNS server

This setting allows you to specify the DNS server that you want to use for name resolution for this virtual network. It does not create a DNS server.

  1. On the Settings page for your virtual network, navigate to DNS Servers and click to open the DNS servers blade.
  2. On the DNS Servers page, under DNS servers, select Custom.
  3. In the DNS Server field, in the Add DNS server box, enter the IP address of the DNS server that you want to use for name resolution.
  4. When you are done adding DNS servers, click Save at the top of the blade to save your configuration.

    Custom DNS

4. Create a gateway subnet

Before connecting your virtual network to a gateway, you first need to create the gateway subnet for the virtual network to which you want to connect. If possible, it's best to create a gateway subnet using a CIDR block of /28 or /27 in order to provide enough IP addresses to accommodate additional future configuration requirements.

If you are creating this configuration as an exercise, refer to these values when creating your gateway subnet.

To create a gateway subnet

  1. In the portal, navigate to the Resource Manager virtual network for which you want to create a virtual network gateway.
  2. In the Settings section of your VNet blade, click Subnets to expand the Subnets blade.
  3. On the Subnets blade, click +Gateway subnet at the top. This will open the Add subnet blade.

    Add the gateway subnet

  4. The Name for your subnet will automatically be filled in with the value 'GatewaySubnet'. This value is required in order for Azure to recognize the subnet as the gateway subnet. Adjust the auto-filled Address range values to match your configuration requirements.

    Adding the subnet

  5. Click OK at the bottom of the blade to create the subnet.

5. Create a virtual network gateway

If you are creating this configuration as an exercise, you can refer to the sample configuration values.

To create a virtual network gateway

  1. In the portal, on the left side, click + and type "Virtual Network Gateway" in search. Locate Virtual network gateway in the search return and click the entry. On the Virtual network gateway blade, click Create at the bottom of the blade. This opens the Create virtual network gateway blade.
  2. On the Create virtual network gateway blade, fill in the values for your virtual network gateway.

    Create virtual network gateway blade fields

  3. Name: Name your gateway. This is not the same as naming a gateway subnet. It's the name of the gateway object you are creating.
  4. Gateway type: Select VPN. VPN gateways use the virtual network gateway type VPN.
  5. VPN type: Select the VPN type that is specified for your configuration. Most configurations require a Route-based VPN type.
  6. SKU: Select the gateway SKU from the dropdown. The SKUs listed in the dropdown depend on the VPN type you select.
  7. Location: Adjust the Location field to point to the location where your virtual network is located. If the location is not pointing to the region where your virtual network resides, the virtual network will not appear in the 'Choose a virtual network' dropdown.
  8. Choose the virtual network to which you want to add this gateway. Click Virtual network to open the Choose a virtual network blade. Select the VNet. If you don't see your VNet, make sure the Location field is pointing to the region in which your virtual network is located.
  9. Choose a public IP address. Click Public IP address to open the Choose public IP address blade. Click +Create New to open the Create public IP address blade. Input a name for your public IP address. This blade creates a public IP address object to which a public IP address will be dynamically assigned.
    Click OK to save your changes to this blade.
  10. Subscription: Verify that the correct subscription is selected.
  11. Resource group: This setting is determined by the Virtual Network that you select.
  12. Don't adjust the Location after you've specified the previous settings.
  13. Verify the settings. You can select Pin to dashboard at the bottom of the blade if you want your gateway to appear on the dashboard.
  14. Click Create to begin creating the gateway. The settings will be validated and you'll see the "Deploying Virtual network gateway" tile on the dashboard. Creating a gateway can take up to 45 minutes. You may need to refresh your portal page to see the completed status.

    Deploying Virtual network gateway

  15. After the gateway is created, you can view the IP address that has been assigned to it by looking at the virtual network in the portal. The gateway will appear as a connected device. You can click the connected device (your virtual network gateway) to view more information.

6. Create a local network gateway

The 'local network gateway' refers to your on-premises location. Give the local network gateway a name by which Azure can refer to it.

If you are creating this configuration as an exercise, you can refer to the sample configuration values.

To create a local network gateway

  1. In the portal, from All resources, click +Add. In the Everything blade search box, type Local network gateway, then click to search. This will return a list. Click Local network gateway to open the blade, then click Create to open the Create local network gateway blade.

    create local network gateway

  2. On the Create local network gateway blade, specify a Name for your local network gateway object.

  3. Specify a valid public IP address for the VPN device or virtual network gateway to which you want to connect.
    If this local network represents an on-premises location, this is the public IP address of the VPN device that you want to connect to. It cannot be behind NAT and has to be reachable by Azure.
    If this local network represents another VNet, you will specify the public IP address that was assigned to the virtual network gateway for that VNet.
  4. Address Space refers to the address ranges for the network that this local network represents. You can add multiple address space ranges. Make sure that the ranges you specify here do not overlap with ranges of other networks that you want to connect to.
  5. For Subscription, verify that the correct subscription is showing.
  6. For Resource Group, select the resource group that you want to use. You can either create a new resource group, or select one that you have already created.
  7. For Location, select the location that this object will be created in. You may want to select the same location that your VNet resides in, but you are not required to do so.
  8. Click Create to create the local network gateway.

7. Configure your VPN device

To configure your VPN device, you'll need the public IP address of the virtual network gateway for configuring your on-premises VPN device. Work with your device manufacturer for specific configuration information and configure your device. Refer to the VPN Devices for more information about VPN devices that work well with Azure.

To find the public IP address of your virtual network gateway using PowerShell, use the following sample:

Get-AzureRmPublicIpAddress -Name GW1PublicIP -ResourceGroupName TestRG

You can also view the public IP address for your virtual network gateway by using the Azure portal. Navigate to Virtual network gateways, then click the name of your gateway.

8. Create a Site-to-Site VPN connection

Create the Site-to-Site VPN connection between your virtual network gateway and your VPN device. Be sure to replace the values with your own. The shared key must match the value you used for your VPN device configuration.

Before beginning this section, verify that your virtual network gateway and local network gateways have finished creating. If you are creating this configuration as an exercise, refer to these values when creating your connection.

To create the VPN connection

  1. Locate your virtual network gateway and click All settings to open the Settings blade.
  2. On the Settings blade, click Connections, and then click Add at the top of the blade to open the Add connection blade.

    Create Site-to-Site connection

  3. On the Add connection blade, Name your connection.
  4. For Connection type, select Site-to-site(IPSec).
  5. For Virtual network gateway, the value is fixed because you are connecting from this gateway.
  6. For Local network gateway, click Choose a local network gateway and select the local network gateway that you want to use.
  7. For Shared Key, the value here must match the value that you are using for your local VPN device. If your VPN device on your local network doesn't provide a shared key, you can make one up and input it here and on your local device. The important thing is that they both match.
  8. The remaining values for Subscription, Resource Group, and Location are fixed.
  9. Click OK to create your connection. You'll see Creating Connection flash on the screen.
  10. When the connection is complete, you'll see it appear in the Connections blade for your Gateway.

    Create Site-to-Site connection

9. Verify the VPN connection

You can verify your VPN connection either in the portal, or by using PowerShell.

To verify your connection by using PowerShell

You can verify that your connection succeeded by using the Get-AzureRmVirtualNetworkGatewayConnection cmdlet, with or without -Debug.

  1. Use the following cmdlet example, configuring the values to match your own. If prompted, select 'A' in order to run 'All'. In the example, -Name refers to the name of the connection that you created and want to test.

     Get-AzureRmVirtualNetworkGatewayConnection -Name MyGWConnection -ResourceGroupName MyRG
  2. After the cmdlet has finished, view the values. In the example below, the connection status shows as 'Connected' and you can see ingress and egress bytes.

       "name": "MyGWConnection",
       "properties": {
         "provisioningState": "Succeeded",
         "resourceGuid": "1c484f82-23ec-47e2-8cd8-231107450446b",
         "virtualNetworkGateway1": {
         "localNetworkGateway2": {
         "connectionType": "IPsec",
         "routingWeight": 10,
         "sharedKey": "abc123",
         "connectionStatus": "Connected",
         "ingressBytesTransferred": 33509044,
         "egressBytesTransferred": 4142431

To verify your connection by using the Azure portal

In the Azure portal, you can view the connection status by navigating to the connection. There are multiple ways to do this. The following steps show one way to navigate to your connection and verify.

  1. In the Azure portal, click All resources and navigate to your virtual network gateway.
  2. On the blade for your virtual network gateway, click Connections. You can see the status of each connection.
  3. Click the name of the connection that you want to verify to open Essentials. In Essentials, you can view more information about your connection. The Status is 'Succeeded' and 'Connected' when you have made a successful connection.

    Verify connection

Next steps