New-AzVpnClientIpsecPolicy

Module:

Az.Network

This command allows the users to create the Vpn ipsec policy object specifying one or all values such as IpsecEncryption,IpsecIntegrity,IkeEncryption,IkeIntegrity,DhGroup,PfsGroup to set on the VPN gateway. This command let output object is used to set vpn ipsec policy for both new / existing gateway.

Syntax

New-AzVpnClientIpsecPolicy
   [-SALifeTime <Int32>]
   [-SADataSize <Int32>]
   [-IpsecEncryption <String>]
   [-IpsecIntegrity <String>]
   [-IkeEncryption <String>]
   [-IkeIntegrity <String>]
   [-DhGroup <String>]
   [-PfsGroup <String>]
   [-DefaultProfile <IAzureContextContainer>]
   [<CommonParameters>]

Description

This command allows the users to create the Vpn ipsec policy object specifying one or all values such as IpsecEncryption,IpsecIntegrity,IkeEncryption,IkeIntegrity,DhGroup,PfsGroup to set on the VPN gateway. This command let output object is used to set vpn ipsec policy for both new / existing gateway.

Examples

Example 1: Define vpn ipsec policy object:

$vpnclientipsecpolicy = New-AzVpnClientIpsecPolicy -IpsecEncryption AES256 -IpsecIntegrity SHA256 -SALifeTime 86472 -SADataSize 429497 -IkeEncryption AES256 -IkeIntegrity SHA256 -DhGroup DHGroup2 -PfsGroup None

This cmdlet is used to create the vpn ipsec policy object using the passed one or all parameters' values which user can pass to param:VpnClientIpsecPolicy of PS command let: New-AzVirtualNetworkGateway (New VPN Gateway creation) / Set-AzVirtualNetworkGateway (existing VPN Gateway update) in ResourceGroup :

Example 2: Create new virtual network gateway with setting vpn custom ipsec policy:

$vnetGateway = New-AzVirtualNetworkGateway -ResourceGroupName vnet-gateway -name myNGW -location $location -IpConfigurations $vnetIpConfig -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1 -VpnClientIpsecPolicy $vpnclientipsecpolicy

This cmdlet returns virtual network gateway object after creation.

Example 3: Set vpn custom ipsec policy on existing virtual network gateway:

$vnetGateway = Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gateway -VpnClientIpsecPolicy $vpnclientipsecpolicy

This cmdlet returns virtual network gateway object after setting vpn custom ipsec policy.

Example 4: Get virtual network gateway to see if vpn custom policy is set correctly:

$gateway = Get-AzVirtualNetworkGateway -ResourceGroupName vnet-gateway -name myNGW

This cmdlet returns virtual network gateway object.

Parameters

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with Azure.

Type:	IAzureContextContainer
Aliases:	AzContext, AzureRmContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DhGroup

The VpnClient DH Groups used in IKE Phase 1 for initial SA

Type:	String
Accepted values:	DHGroup24, ECP384, ECP256, DHGroup14, DHGroup2
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IkeEncryption

The VpnClient IKE encryption algorithm (IKE Phase 2)

Type:	String
Accepted values:	GCMAES256, GCMAES128, AES256, AES128
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IkeIntegrity

The VpnClient IKE integrity algorithm (IKE Phase 2)

Type:	String
Accepted values:	SHA384, SHA256
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IpsecEncryption

The VpnClient IPSec encryption algorithm (IKE Phase 1)

Type:	String
Accepted values:	GCMAES256, GCMAES128, AES256, AES128
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-IpsecIntegrity

The VpnClient IPSec integrity algorithm (IKE Phase 1)

Type:	String
Accepted values:	GCMAES256, GCMAES128, SHA256
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-PfsGroup

The VpnClient PFS Groups used in IKE Phase 2 for new child SA

Type:	String
Accepted values:	PFS24, PFSMM, ECP384, ECP256, PFS14, PFS2, None
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SADataSize

The VpnClient IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB

Type:	Int32
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SALifeTime

The VpnClient IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds

Type:	Int32
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

None

Outputs

PSIpsecPolicy