There is an address space on the Azure site 10.20.70.0/16 I want to create subnets in it 10.20.70.0/27 10.20.70.32/27 10.20.70.64/27 10.20.70.96/27 I don't want to indicate a bunch of second phases in the IPsec tunnel, each of which will refer to its own subnet. And make only one that will refer to 10.20.70.0/24. Will it work like that, and will it be stable? I understand that if the connection drops from 10.20.70.0/24, all subnets will not be available and if I configure connections to the subnets separately, then if one connection fails, the others would remain to work. I am more interested in the issue of the operation of the IPsec protocol itself. Which way is better to configure? Multiple / 27 connections in the tunnel - to each subnet, or will one / 24 connection work just as well?

Hi, You configure the Traffic Selector as the entire address space of your VNET. That is the recommended TS config from Microsoft end. When Azure negotiates, we uses 0.0.0.0 as TSi and based on what you have configured, we narrow it down. So its best you configure the entire address space of the VNET, in this case, its 10.20.70.0/16 Regards, Msrini

Network segmentation and IPSec VPN

Accepted answer

msrini-MSFT 9,286 Reputation points Microsoft Employee

2020-06-20T21:53:42.317+00:00

Hi,

You configure the Traffic Selector as the entire address space of your VNET. That is the recommended TS config from Microsoft end.

When Azure negotiates, we uses 0.0.0.0 as TSi and based on what you have configured, we narrow it down. So its best you configure the entire address space of the VNET, in this case, its 10.20.70.0/16

Regards,
Msrini
Please sign in to rate this answer.

1 person found this answer helpful.
Artem Kulikovskyi 21 Reputation points

2020-06-21T08:53:37.95+00:00

Thank you Msrini,

Initially, I set up the Traffic selector as 10.20.70.0/16.
But for a more stable VPN connection, an external contractor recommended that I narrow the subnet for the traffic selector. In the entire Azure network, no more than 10 servers are planned. Based on your words, will I need to delete the current network settings and create a new address space with a smaller range?

Or reducing the range does not affect the stability of the network(VPN) and I should not change anything?

msrini-MSFT 9,286 Reputation points Microsoft Employee

2020-06-21T13:28:50.097+00:00

Before doing that I have few questions for you:

What is your On-Prem device ?

Is your device listed in the validated devices list as per our doc ?

Are you using route based gateway or Policy based Gateway ?

Are you using IKEv1 or IKEv2 for your connection ?

Artem Kulikovskyi 21 Reputation points

2020-06-21T14:09:57.87+00:00

Ok, answers below

FortiGate 60E

Yes

Route-based

IKEv2

msrini-MSFT 9,286 Reputation points Microsoft Employee

2020-06-21T16:47:29.933+00:00

Alright, since it is IKEv2 , you can go ahead and configure the TS as then entire address space of the VNET. Reducing the address space is not recommended.

Artem Kulikovskyi 21 Reputation points

2020-06-21T18:10:29.377+00:00

Thank you.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Network segmentation and IPSec VPN

0 additional answers

Your answer