Configure customer premises equipment for Global Secure Access (preview)

IPSec tunnel is a bidirectional communication. One side of the communication is established when adding a device link to a remote network in Global Secure Access (preview). During that process, you enter your public IP address and border gateway protocol (BGP) addresses in the Microsoft Entra admin center to tell us about your network configurations.

This article provides the steps to set up the other side of the communication channel.

Prerequisites

To configure your customer premises equipment (CPE), you must have:

• A Global Secure Access Administrator role in Microsoft Entra ID.
• The preview requires a Microsoft Entra ID P1 license. If needed, you can purchase licenses or get trial licenses.
• To configure your CPE, you must have completed the Global Secure Access onboarding process.

How to configure your customer premises equipment

You can set up the CPE using the Microsoft Entra admin center or using the Microsoft Graph API. When you create a remote network and add your device link information, configuration details are generated. These details are needed to configure your CPE.

Microsoft Entra admin center

1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

2. Browse to Global Secure Access > Devices > Remote network.

3. Select View configuration for the remote network you need to configure.

   

4. Locate and save Microsoft's public IP address endpoint from the panel that opens.

   

5. In the preferred interface for your CPE, enter the IP address you saved in the previous step. This step completes the IPSec tunnel configuration.

The following diagram highlights each of the major sections of the device configuration details. Text descriptions of each section follow the diagram.

• The branchId and branchName represent the remote network details.
• The displayName is the device link name.
• The endpoint, asn, bgpAddress, and region represent the Microsoft connectivity details. Enter these details on your CPE.
• For zone redundant device links, a second set of details are generated.
• PeerConfiguration and the subsequent details represent the CPE connectivity details.
• If you've configured more devices, their details follow.

Important

The crypto profile you specified for the device link should match with what you specify on your CPE. If you chose the "default" IKE policy when configuring the device link, use the configurations described in the Remote network configurations article.

Microsoft Graph API

Follow these instructions to download the connectivity information for your remote network.

1. Sign in to Graph Explorer.

2. Select GET as the HTTP method from the dropdown.

3. Set the API version to beta.

4. Run the following query to list your remote networks and their device links:

   GET https://graph.microsoft.com/beta/networkaccess/connectivity/branches
   

5. Run the following query to get the connectivity information, replacing {branchSiteId} with the ID of your remote network and {deviceLinkId} with the ID of your device link:

   GET https://graph.microsoft.com/beta/networkAccess/connectivity/branches/{branchSiteId}/deviceLinks/{deviceLinkId}
   

The details in the response are similar to the device configuration details found in the Microsoft Entra admin center.

Terms of Use

Your use of the Microsoft Entra Private Access and Microsoft Entra Internet Access preview experiences and features is governed by the preview online service terms and conditions of the agreement(s) under which you obtained the services. Previews may be subject to reduced or different security, compliance, and privacy commitments, as further explained in the Universal License Terms for Online Services and the Microsoft Products and Services Data Protection Addendum (“DPA”), and any other notices provided with the Preview.

Next steps

• How to manage remote networks
• How to manage remote network device links