Need to setup IP SEC tunnel from Azure Virtual WAN and Cisco cEdge 8000v

Abhishek Singh 0

I was trying to setup site to site IP SEC tunnel from Azure Virtual WAN and Cisco cEdge 8000v. I have tried checking the Azure tutorial but did not find any solution to this. referred Azure Doc: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal Could you please help meana Azure Docthath helps to create Site tosite tunnell between Azure vWAN and Cisco cEdge 8000v

Header 1	Header 2
Cell 1	Cell 2
Cell 3	Cell 4

GitaraniSharma-MSFT 47,421 Reputation points Microsoft Employee

2024-02-22T09:08:02.35+00:00
Hello @Abhishek Singh ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to setup a site-to-site IPsec tunnel between Azure Virtual WAN and Cisco Edge 8000v router.

Devices that connect to Azure Virtual WAN have built-in automation to connect. This is typically set up in the device-management UI (or equivalent), which sets up the connectivity and configuration management between the VPN branch device to an Azure Virtual hub VPN endpoint (VPN gateway). You can check the links in the below article for more information about services offered by Azure Virtual WAN partners.

https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-locations-partners#partners

I couldn't find an existing tutorial to setup site-to-site IPsec tunnel between Azure Virtual WAN and Cisco Edge 8000v router, but you can follow the generic Azure Virtual WAN site to site VPN document and add the required details in portal to configure the site and connection.

Refer: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal

Link IP address/FQDN: This is the Public IP address of your Cisco Edge 8000v Router.

Link BGP Address: Your on-premises BGP peer address must not be the same as the public IP address of your VPN to device or the VNet address space of the VPN site. Use a different IP address on the VPN device for your BGP peer IP. It can be an address assigned to the loopback interface on the device. Specify this address in the corresponding VPN site representing the location. For BGP prerequisites, see About BGP with Azure VPN Gateway.

Link ASN: You can use your own public ASNs or private ASNs for both your on-premises networks and Azure virtual networks. You can't use the ranges reserved by Azure or IANA.

For more information on BGP IP and ASN, please refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#bgp

Regards,

Gita
Abhishek Singh 0 Reputation points

2024-02-26T09:39:57.8266667+00:00

Hi Gita, Thanks for looking into my query. Appreciate your information mentioned in this query. I already gone through multiple MS and Cisco Article and yours as well, but now concrete resolution i get. Please find the attached architecture , which want to create, specifically the tunnel. Please provide you suggestion to create the tunnels show in the architecture. Thanks Abhishek
KapilAnanth-MSFT 35,086 Reputation points Microsoft Employee

2024-02-29T05:04:07.0533333+00:00
@Abhishek Singh ,

Greetings.

Can you be more specific as to what is required from the Azure side configuration.

VPN Site represents the OnPrem site. See : Create a site

And each link represents the Public IPs (ISPs) of the devices you have

Now if you have 2 devices, you have to specify both of them here.

Azure vWAN VPN Gateways are always active-active - This means, a single "Connection" will yield 2 Tunnels per Link

So in your case you will have 4 Tunnels established as shown

Instance0 --------- CiscoRouter1

Instance0 --------- CiscoRouter2

Instance1 --------- CiscoRouter1

Instance1 --------- CiscoRouter2

A complete detail on how a configuration file should look like is given here

Experts in Microsoft Q&A Community may not be aware of the configuration for 3rd party devices/services (such as CISCO Router).

I would suggest you to get this clarified in the 3rd party's documents/forums on how to configure it.

As our Branch IPsec connectivity partners, I could find the configurations for Azure Virtual WAN Cisco Meraki Deployment Guide and vMX and Azure vWAN.

Hope this helps.

Cheers,

Kapil.
GitaraniSharma-MSFT 47,421 Reputation points Microsoft Employee

2024-03-04T11:15:45.31+00:00

@Abhishek Singh , could you please provide an update on this thread? Did you get a chance to go through the comment posted by @KapilAnanth-MSFT above? Kindly let us know if the above helps or you need further assistance on this issue.