Add and delete remote networks device links

Customer premises equipment, such as routers, are added to the remote network. You can create device links when you create a new remote network or add them after the remote network is created. This article explains how to add and delete device links for remote networks for Global Secure Access.

Prerequisites

To configure remote networks, you must have:

• A Global Secure Access Administrator role in Microsoft Entra ID.
• Created a remote network.
• The product requires licensing. For details, see the licensing section of What is Global Secure Access. If needed, you can purchase licenses or get trial licenses.

Add a device link

You can add a device link from the Microsoft Entra admin center or using the Microsoft Graph API.

Microsoft Entra admin center

You can add a device link to a remote network at any time.

1. Browse to Global Secure Access > Connect > Remote networks.

2. Select a remote network from the list.

3. Select Links from the menu.

4. Select + Add a link.

Add a link - General tab

There are several details to enter on the General tab. Pay close attention to the Peer and Local Border Gateway Protocol (BGP) addresses. The peer and local details are reversed, depending on where the configuration is completed.

1. Enter the following details.
   • Link name: Name of your Customer Premises Equipment (CPE).
   • Device type: Choose a device option from the dropdown list.
   • Device IP address: Public IP address of your CPE (customer premise equipment) device.
   • Device BGP address: Enter the BGP IP address of your CPE.
     • This address is entered as the local BGP IP address on the CPE.
   • Device ASN: Provide the autonomous system number (ASN) of the CPE.
     • A BGP-enabled connection between two network gateways requires that they have different ASNs.
     • For more information, see the Valid ASNs section of the Remote network configurations article.
   • Redundancy: Select either No redundancy or Zone redundancy for your IPSec tunnel.
   • Zone redundancy local BGP address: This optional field shows up only when you select Zone redundancy.
     • Enter a BGP IP address that isn't part of your on-premises network where your CPE resides and is different from the Device BGP address.
   • Bandwidth capacity (Mbps): Specify tunnel bandwidth. Available options are 250, 500, 750, and 1,000 Mbps.
   • Local BGP address: Enter a BGP IP address that isn't part of your on-premises network where your CPE resides.
     • For example, if your on-premises network is 10.1.0.0/16, then you can use 10.2.0.4 as your Local BGP address.
     • This address is entered as the peer BGP​​ IP address on your CPE.
     • Refer to the valid BGP addresses list for reserved values that can't be used.
2. Select Next.

Add a link - Details tab

The Details tab is where you establish the bidirectional communication channel between Global Secure Access and your CPE. Configure your IPSec/IKE policy and select Next.

• IKEv2 is selected by default. Currently only IKEv2 is supported.
• The IPSec/IKE policy is set to Default but you can change to Custom.
• If you choose the custom IPSec/IKE policy, first review the How to create remote network with custom Internet Key Exchange (IKE) policy article.
• If you select Custom, you must use a combination of settings that are supported by Global Secure Access. The valid configurations you can use are mapped out in the Remote network valid configurations reference article.
• Whether you choose Default or Custom, the IPSec/IKE policy you specify must match the policy you enter on your CPE.

Add a link - Security tab

1. Enter the Pre-shared key (PSK) and Zone Redundancy Pre-shared key (PSK). The same secret key must be used on your respective CPE. The Zone Redundancy Pre-shared key (PSK) field only appears if you set up redundancy on the first page in creating the link.
2. Select the Save button.

Microsoft Graph API

Remote networks with a custom IKE policy can be created using Microsoft Graph on the /beta endpoint.

1. Sign in to Graph Explorer.

2. Select POST as the HTTP method from the dropdown.

3. Set the API version to beta.

4. Run the following query to get a list of your remote networks and their details.

   GET https://graph.microsoft.com/beta/networkAccess/connectivity/remoteNetworks
   

5. Run the following query to get the device link details.

   POST https://graph.microsoft.com/beta/networkAccess/connectivity/remoteNetworks/{remoteNetworkId}/deviceLinks
   

Sample response:

{
    "name": "CPE3",
    "ipAddress": "20.55.91.42",
    "deviceVendor": "ciscoMeraki",
    "bandwidthCapacityInMbps": "mbps1000",
    "bgpConfiguration": {
        "localIpAddress": "192.168.1.2",
        "peerIpAddress": "10.2.2.2",
        "asn": 65533
    },
    "redundancyConfiguration": {
        "redundancyTier": "zoneRedundancy",
        "zoneLocalIpAddress": "192.168.1.3"
    },
    "tunnelConfiguration": {
        "@odata.type": "#microsoft.graph.networkaccess.tunnelConfigurationIKEv2Default",
        "preSharedKey": "test123"
    }
}

How to delete device links

You can delete device links through the Microsoft Entra admin center and using the Microsoft Graph API.

Microsoft Entra admin center

1. Sign in to the Microsoft Entra admin center as a Global Secure Access Administrator.

2. Browse to Global Secure Access > Connect > Remote networks. Device links appear in the Links column on the list of remote networks.

3. Select the device link from the Links column to access the device link details page.

4. Select Delete for the device link you want to delete. A confirmation dialog appears. Select Delete to confirm the deletion.

   

Microsoft Graph API

1. Sign in to Graph Explorer.

2. Select DELETE as the HTTP method from the dropdown.

3. Set the API version to beta.

4. Enter the following query.

   DELETE https://graph.microsoft.com/beta/networkAccess/connectivity/remotenetworks/{remoteNetworkId}/deviceLinks/{deviceLinkId}