How to Whitelist IPs on Azure VPN Gateway

Question

Hello Azure Team
I setup Site-to-Site VPN with an on-premises infra. The status remains not connected even after a troubleshooting session with team from the other side where we compare item by item. They insisted that settings only allow for our IPs to be whitelisted just as it's done for Local Network Gateway. By the way, this is the design by most cloud providers (AWS, GCP). Is there a way to force IP whitelisting on azure VPN gateway and why this design?

Thank you

Seun

Answer 1

Hello @Seun Ore ,

I understand that you would like to force IP whitelisting on your Azure VPN gateway.

If your requirement is to restrict/configure more specific routes/address prefixes from your on-premises to Azure:

You can use BGP to support automatic and flexible prefix updates. BGP can also enable transit routing among multiple networks by propagating routes a BGP gateway learns from one BGP peer to all other BGP peers. With BGP, you only need to declare a minimum prefix to a specific BGP peer over the IPsec S2S VPN tunnel. You can control which on-premises network prefixes you want to advertise to Azure to allow your Azure Virtual Network to access.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp-overview

But if your requirement is to restrict/configure more specific routes/address prefixes via the VPN tunnel from Azure to your on-premises:

You can do so using the New-AzIpsecTrafficSelectorPolicy command.

Traffic selectors can be defined via the trafficSelectorPolicies attribute on a connection via the New-AzIpsecTrafficSelectorPolicy PowerShell command. For the specified traffic selector to take effect, ensure the Use Policy Based Traffic Selectors option is enabled.

The custom configured traffic selectors will be proposed only when an Azure VPN gateway initiates the connection. A VPN gateway accepts any traffic selectors proposed by a remote gateway (on-premises VPN device). This behavior is consistent between all connection modes (Default, InitiatorOnly, and ResponderOnly).

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#can-i-specify-my-own-policy-based-traffic-selectors

Policy-based traffic selector option can be specified with Default policy, without the custom IPsec/IKE policy.

Ex: Your Vnet address range is 10.0.0.0/23 but you do not want to advertise the whole range to your on-prem via VPN tunnel but would like to advertise smaller ranges such as 10.0.0.0/27, 10.0.0.32/27, 10.0.0.64/26 & so on, then you can define it as below:

$trafficSelectorPolicy = New-AzIpsecTrafficSelectorPolicy -LocalAddressRange ("10.0.0.0/27", "10.0.0.32/27", "10.0.0.64/26") -RemoteAddressRange ("192.168.10.0/24", "172.16.0.0/24")
New-AzVirtualNetworkGatewayConnection -ResourceGroupName $rgname -name $vnetConnectionName -location $location -VirtualNetworkGateway1 $vnetGateway -LocalNetworkGateway2 $localnetGateway -ConnectionType IPsec -RoutingWeight 3 -SharedKey $sharedKey -UsePolicyBasedTrafficSelectors $true -TrafficSelectorPolicy ($trafficSelectorPolicy)

• LocalAddressRange contains the smaller address ranges from within your Azure Vnet.
• RemoteAddressRange contains your on-prem network ranges configured in your local network gateway.

You can also set custom traffic selectors in your VPN connection using Azure Portal as below:

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto#what-are-the-algorithms-and-key-strengths-supported-in-the-custom-policy

https://learn.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto#policy-parameters

Adding or updating an IPsec/IKE policy could cause a small disruption (a few seconds) as the Azure VPN gateway tears down the existing connection and restarts the IKE handshake to re-establish the IPsec tunnel with the new cryptographic algorithms and parameters. Ensure your on-premises VPN device is also configured with the matching algorithms and key strengths to minimize the disruption.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-compliance-crypto#would-adding-or-updating-an-ipsecike-policy-disrupt-my-vpn-connection

But this will only affect the connection you are working with. Any other existing connections will not be affected.

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.