h2>Summa/h2>
This pst will shw u hw t cnnect a lcal ffice site t a Windws Azue Vitual Netwk thugh the use f a sftwae VPN device A sftwae VPN device is paticulal useful when peating in a pttpe mde building a “dev/test” wkflw whee u want t bust t the clud fast Indeed even in the Windws Azue Vitual Netwks team, we use these techniques in an autmated wa t test u wn cde in Pductin (TiP) as the Azue platfm is cnstantl shifting eve da beneath us This pst will shw hw t cnfigue a hef=https://wwwpenswang/>OpenSwan/a> VPN n Linux t cnnect t a vitual netwk hsted in Windws Azue
h2>Linux/h2>
F Linux, we will use a vitual machine ceated inside Windws Azue t cnnect t a Vitual Netwk hsting anthe Linux Vitual Machine t shw hw this can be dne

a hef=https://acmazuecmcdnnet/8C57D/blgmedia/blgmedia/214/5/14png>img stle=flat: nne; padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Ceate Vitual Machine UI alt=Ceate Vitual Machine UI sc=https://azuecmcdnazueedgenet/mediahandle/acmblg/media/Default/blg/14_thumbpng width=36 height=14 bde= />/a>

The fist step is t g ahead and ceate a new Vitual Machine that will hst the OpenSwan VPN In this case I used the Ubuntu 144 platfm image with an exta small ce but an f the Linux images can be used and u can f cuse bing u wn VHD t
table width=682 bde= cellspacing= cellpadding=2>
tbd>
t>
td valign=tp width=2>a hef=https://acmazuecmcdnnet/8C57D/blgmedia/blgmedia/214/5/15png>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Azue Vitual Machine IP Addesses alt=Azue Vitual Machine IP Addesses sc=https://azuecmcdnazueedgenet/mediahandle/acmblg/media/Default/blg/15_thumbpng width=196 height=18 bde= />/a>/td>
td valign=tp width=48>
p align=justif>Once the VM is ceated, ensue als, that pts 5 and 45 (bth UDP) a hef=https://azuemicsftcm/en-us/dcumentatin/aticles/vitual-machines-set-up-endpints/>ae pened t/a> as IPSec depends n these Fm the ptal UI, thee ae tw inteesting atifacts t nte, thse f the public vitual IP (VIP) and the intenal IP We can use these ppeties t ceate a lcal site f a vitual netwk which we will then cnnect t a new Vitual Netwk Once u have nted these ppeties, g ahead and ceate a new lcal site unde the Netwks sectin f the ptal/p>
/td>
/t>
/tbd>
/table>
Click n Netwks tab in the ptal then the Lcal Netwks sectin t begin the add lcal netwk pcess:

 

a hef=https://acmazuecmcdnnet/8C57D/blgmedia/blgmedia/214/5/F17png>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde: px; title=Vitual Netwks Lcal Netwks tab alt=Vitual Netwks Lcal Netwks tab sc=https://azuecmcdnazueedgenet/mediahandle/acmblg/media/Default/blg/F17_thumbpng width=353 height=81 bde= />/a>

a hef=https://acmazuecmcdnnet/8C57D/blgmedia/blgmedia/214/5/f3png>img stle=flat: nne; padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Add Lcal Netwk UI Wizad alt=Add Lcal Netwk UI Wizad sc=https://azuecmcdnazueedgenet/mediahandle/acmblg/media/Default/blg/f3_thumbpng width=36 height=161 bde= />/a>

Add the public IP as the VPN device IP and g ahead and use the intenal IP as the lcal site Yu can use a single /32 f the lcal site if u wish t make the scenai a little me ealistic, feel fee t use a bigge subnet, thugh these IPs in the wide subnet will nt be utable unless the ae in the same tenant as the Vitual Machine Yu can als add sme exta netwk intefaces t u vitual machine t shw the use f the wide subnet Click the new buttn in the left cne and add a new lcal netwk

 
p align=left>a hef=https://acmazuecmcdnnet/8C57D/blgmedia/blgmedia/214/5/f9png>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Add Azue Lcal Netwk dialg alt=Add Azue Lcal Netwk dialg sc=https://azuecmcdnazueedgenet/mediahandle/acmblg/media/Default/blg/f9_thumbpng width=36 height=214 bde= />/a> a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Azue vitual netwk lcal site dialg alt=Azue vitual netwk lcal site dialg sc= width=36 height=82 bde= />/a>/p>
In this case we have specified a /24 subnet which the ptal indicates that we can have 255 IPs in this subnet, hweve nl the intenal IP addess f the VM hsting the “lcal site” will be addessable as Azue’s secuit mdel will nt allw packets t each the VMs in this subnet Yu can hweve add multiple netwk intefaces t the VM with thei wn IPs within this subnet t simulate me IPs Once this is dne g ahead and ceate the Vitual Netwk ensuing that u cnfigue the Vitual Netwk t cmmunicate the Lcal Site that was just ceated b checking the bx and saving the update

 

a hef=>img stle=flat: nne; padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Azue vitual netwk ceate vitual netwk dialg alt=Azue vitual netwk ceate vitual netwk dialg sc= width=36 height=99 bde= />/a>

a hef=>img stle=flat: nne; padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Enable Azue Vitual netwk cnnectin t the lcal netwk alt=Enable Azue Vitual netwk cnnectin t the lcal netwk sc= width=36 height=23 bde= />/a>
table width=714 bde= cellspacing= cellpadding=2>
tbd>
t>
td valign=tp width=585>
p align=justif>Once these steps have been cmpleted g ahead and ceate a Static Ruting (IKEv1) Gatewa via the ptal While the Gatewa ceatin is taking place (a few minutes), we can begin the pcess f cnfiguing the OpenSwan VPN seve with the ight settings t get cnnected t the Windws Azue Vitual Netwk/p>
/td>
td valign=tp width=127>a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Ceate a static uting (IKEv1) Gatewa alt=Ceate a static uting (IKEv1) Gatewa sc= width=98 height=118 bde= />/a>/td>
/t>
/tbd>
/table>
 
h2>Cnfiguing the Linux VPN/h2>
The fist step is t use a secue shell client like PuTT and cnnect t u Linux Vitual Machine Once cnnected u will want t actuall install the OpenSwan sftwae and cnfigue it This can be dne via the apt-get cmmand (dist specific – s chse whateve is apppiate) belw:

b>sud apt-get install penswan/b>

Select N if asked abut using X59 cets as the authenticatin methd as we will use shaed ke secets t secue the IPSec tunnel If the install is successful a quick check f the lcal path will shw a pgam called ipsec is installed:

b>which ipsec/b>

b>/us/sbin/ipsec/b>

Yu can install OpenSwan fm suces t shuld u wish, but u need t install all the necessa build tls (nt n Azue platfm image b default)

T cnfigue the VPN itself, we need t edit the fllwing file

b>sud vi /etc/ipseccnf/b>

Yu will see the fllwing:
pe class=pettpint>cnfig setup
ptstack=netke
vitual_pivate=%v4:188124/24
e=ff
# D nt set debug ptins t debug cnfiguatin issues!
# plutdebug / klipsdebug = all, nne a cmbatin fm belw:
# aw cpt pasing emitting cntl klips pfke natt x59 dpd pivate
# eg:
# plutdebug=cntl pasing
# Again: nl enable plutdebug klipsdebug when asked b a develpe
#
# enable t get lgs pe-pee
# plutpts=–pepeelg
#
# Enable ce dumps (might equie sstem changes, like ulimit -C)
# This is equied f abtd t wk ppel
# Nte: incect SElinux plicies might pevent plut witing the ce
dumpdi=/va/un/plut/
#
# NAT-TRAVERSAL suppt, see READMENAT-Tavesal
nat_tavesal=es
# exclude netwks used n seve side b adding %v4:!abc/24
# It seems that T-Mbile in the US and Rges/Fid in Canada ae
plutstdelg=~/swanlg
include /etc/ipsecd/*cnf/pe>
Change the cnfig t esemble abve, nl the subnet ceated f the lcal site shuld change t match what was ceated f the lcal site step, in this case 188124/24

If u wish t see the lcal IPSec lgs, uncmment the plutdebug ptin

Belw this u need t make changes f cnnectin specific settings:
table width=158 bde= cellspacing= cellpadding=2>
tbd>
t>
td valign=tp width=496>
pe class=pettpint>cnn vpn
authb=secet
aut=stat
tpe=tunnel
left=18812418
leftsubnet=188124/24
leftnexthp=%defaultute
ight=137117136XXX
ightsubnet=192168/2
ike=3des-sha1-mdp124,aes128-sha1-mdp124
esp=3des-sha1,aes128-sha1
pfs=n/pe>
/td>
td valign=tp width=56>
p align=justif>The highlighted epesent tw ppeties that ae available fm the Vitual Netwks UI in the ptal (see sceen shts abve) The fist ent, “ight”, is the VIP f the Gatewa ceated whilst the the, “ightsubnet” epesents the IP space used in the Vitual Netwk n ceatin Yu must als cnfigue the cpt settings hee t and tun ff Pefect Fwading Secec (PFS) ptin Nte als that the cnfig sntax vaies depending n the OpenSwan vesin used, f the exact efeence un the cmmand:/p>
p align=justif>b>man ipseccnf/b>/p>
/td>
/t>
/tbd>
/table>
 

a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=The gatewa VIP t cnfigue the cnnectin t alt=The gatewa VIP t cnfigue the cnnectin t sc= width=237 height=76 bde= />/a>a hef=>img stle=flat: nne; padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=The n-pemises netwk ange alt=The n-pemises netwk ange sc= width=36 height=92 bde= />/a>
table width=152 bde= cellspacing= cellpadding=2>
tbd>
t>
td valign=tp width=494>a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=The Vitual Netwk pe-shaed ke alt=The Vitual Netwk pe-shaed ke sc= width=36 height=14 bde= />/a>/td>
td valign=tp width=556>
p align=justif>The final step is t gathe the Pe-shaed Ke (PSK) fm the Azue ptal and cnfigue this n the Linux VM Cp the PSK and then edit the fllwing file:/p>
p align=justif>b>sud vi /etc/ipsecsecets/b>/p>
p align=justif>The exact sntax is as fllws: LcalIP GatewaVIP : PSK ‘’Shaed Ke‘’/p>

pe class=pettpint>#include /etc/ipsecd/*secets
18812418 13711713623 : PSK XXXXXXXXXXXXXXXXXXXX/pe>
/td>
/t>
/tbd>
/table>
 

Once dne, un the span stle=backgund-cl: #ff;>span stle=backgund-cl: #ffffff;>fllwing/span>/span> cmmands t lad the PSK int the unning IPSec sevice, then span stle=backgund-cl: #4bacc6;>span stle=backgund-cl: #ffffff;>estat/span>/span> the sevice befe span stle=backgund-cl: #cccccc;>span stle=backgund-cl: #ffffff;>checking/span>/span> that the tunnel is up
l>
li>span stle=cl: #;>b>span stle=backgund-cl: #ff;>span stle=backgund-cl: #ffffff;>sud ipsec secets/span>/span>/b> /span>/li>
li>span stle=backgund-cl: #ffffff;>span stle=cl: #;>b>span stle=cl: #ffffff; backgund-cl: #4bacc6;>span stle=backgund-cl: #ffffff; cl: #;>sud sevice ipsec estat/span>/span>/b> /span>/span>/li>
li>b>span stle=backgund-cl: #cccccc;>span stle=backgund-cl: #ffffff; cl: #;>sud sevice ipsec status/span>/span>/b>/li>
/l>
b>span stle=cl: #;>IPsec unning – plut pid: 63791/span>/b>

b>span stle=cl: #;>plut pid 63791/span>/b>

b>span stle=cl: #;>1 tunnels up/span>/b>

b>span stle=cl: #;>sme eutes exist/span>/b>

Once u have a tunnel up t u Gatewa u will see the Azue Ptal UI update t eflect this fact (the geen link in the UI), and a hef=https://azuemicsftcm/en-us/dcumentatin/aticles/vitual-netwks-add-vitual-machine/>u can depl a vitual machine int the vitual netwk/a> and begin t d sme testing ve the netwk

This example belw depls a Linux VM int the Vitual Netwk and shws netwk cnnectivit fm m lcal netwk subnet (188124/24) fm the machine hsting OpenSwan t the Vitual Machine (1921684) inside the Vitual Netwk in Azue (192168/2)

Yu can see als the data tansfes in and ut f the Vitual Netwk as u use it in the Azue Ptal UI

a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=The Azue Ptal UI f a cnnected VPN cnnectin alt=The Azue Ptal UI f a cnnected VPN cnnectin sc= width=36 height=123 bde= />/a>

a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde: px; title=Ping fm lcal netwk t Azue vitual netwk alt=Ping fm lcal netwk t Azue vitual netwk sc= width=36 height=22 bde= />/a>

a hef=>img stle=padding-tp: px; padding-left: px; padding-ight: px; bde-width: px; title=Ping fm Azue vitual netwk t lcal netwk alt=Ping fm Azue vitual netwk t lcal netwk sc= width=36 height=227 bde= />/a>