Microsoft.Network vpnGateways/vpnConnections 2020-08-01

• Latest
• 2024-05-01
• 2024-03-01
• 2024-01-01
• 2023-11-01
• 2023-09-01
• 2023-06-01
• 2023-05-01
• 2023-04-01
• 2023-02-01
• 2022-11-01
• 2022-09-01
• 2022-07-01
• 2022-05-01
• 2022-01-01
• 2021-08-01
• 2021-05-01
• 2021-03-01
• 2021-02-01
• 2020-11-01
• 2020-08-01
• 2020-07-01
• 2020-06-01
• 2020-05-01
• 2020-04-01
• 2020-03-01
• 2019-12-01
• 2019-11-01
• 2019-09-01
• 2019-08-01
• 2019-07-01
• 2019-06-01
• 2019-04-01
• 2019-02-01
• 2018-12-01
• 2018-11-01
• 2018-10-01
• 2018-08-01
• 2018-07-01
• 2018-06-01
• 2018-04-01

Bicep resource definition

The vpnGateways/vpnConnections resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways/vpnConnections resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/vpnGateways/vpnConnections@2020-08-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    connectionBandwidth: int
    dpdTimeoutSeconds: int
    enableBgp: bool
    enableInternetSecurity: bool
    enableRateLimiting: bool
    ipsecPolicies: [
      {
        dhGroup: 'string'
        ikeEncryption: 'string'
        ikeIntegrity: 'string'
        ipsecEncryption: 'string'
        ipsecIntegrity: 'string'
        pfsGroup: 'string'
        saDataSizeKilobytes: int
        saLifeTimeSeconds: int
      }
    ]
    remoteVpnSite: {
      id: 'string'
    }
    routingConfiguration: {
      associatedRouteTable: {
        id: 'string'
      }
      propagatedRouteTables: {
        ids: [
          {
            id: 'string'
          }
        ]
        labels: [
          'string'
        ]
      }
      vnetRoutes: {
        staticRoutes: [
          {
            addressPrefixes: [
              'string'
            ]
            name: 'string'
            nextHopIpAddress: 'string'
          }
        ]
      }
    }
    routingWeight: int
    sharedKey: 'string'
    useLocalAzureIpAddress: bool
    usePolicyBasedTrafficSelectors: bool
    vpnConnectionProtocolType: 'string'
    vpnLinkConnections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          connectionBandwidth: int
          egressNatRules: [
            {
              id: 'string'
            }
          ]
          enableBgp: bool
          enableRateLimiting: bool
          ingressNatRules: [
            {
              id: 'string'
            }
          ]
          ipsecPolicies: [
            {
              dhGroup: 'string'
              ikeEncryption: 'string'
              ikeIntegrity: 'string'
              ipsecEncryption: 'string'
              ipsecIntegrity: 'string'
              pfsGroup: 'string'
              saDataSizeKilobytes: int
              saLifeTimeSeconds: int
            }
          ]
          routingWeight: int
          sharedKey: 'string'
          useLocalAzureIpAddress: bool
          usePolicyBasedTrafficSelectors: bool
          vpnConnectionProtocolType: 'string'
          vpnLinkConnectionMode: 'string'
          vpnSiteLink: {
            id: 'string'
          }
        }
      }
    ]
  }
}

Property values

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways/vpnConnections

Name	Description	Value
name	The resource name	string (required)
parent	In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource.	Symbolic name for resource of type: vpnGateways
properties	Properties of the VPN connection.	VpnConnectionProperties

PropagatedRouteTable

Name	Description	Value
ids	The list of resource ids of all the RouteTables.	SubResource[]
labels	The list of labels.	string[]

RoutingConfiguration

Name	Description	Value
associatedRouteTable	The resource id RouteTable associated with this RoutingConfiguration.	SubResource
propagatedRouteTables	The list of RouteTables to advertise the routes to.	PropagatedRouteTable
vnetRoutes	List of routes that control routing from VirtualHub into a virtual network connection.	VnetRoute

StaticRoute

Name	Description	Value
addressPrefixes	List of all address prefixes.	string[]
name	The name of the StaticRoute that is unique within a VnetRoute.	string
nextHopIpAddress	The ip address of the next hop.	string

SubResource

Name	Description	Value
id	Resource ID.	string

VnetRoute

Name	Description	Value
staticRoutes	List of all Static Routes.	StaticRoute[]

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
dpdTimeoutSeconds	DPD timeout in seconds for vpn connection.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingConfiguration	The Routing Configuration indicating the associated and propagated route tables on this connection.	RoutingConfiguration
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
egressNatRules	List of egress NatRules.	SubResource[]
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ingressNatRules	List of ingress NatRules.	SubResource[]
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnectionMode	Vpn link connection mode.	'Default' 'InitiatorOnly' 'ResponderOnly'
vpnSiteLink	Id of the connected vpn site link.	SubResource

ARM template resource definition

The vpnGateways/vpnConnections resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways/vpnConnections resource, add the following JSON to your template.

{
  "type": "Microsoft.Network/vpnGateways/vpnConnections",
  "apiVersion": "2020-08-01",
  "name": "string",
  "properties": {
    "connectionBandwidth": "int",
    "dpdTimeoutSeconds": "int",
    "enableBgp": "bool",
    "enableInternetSecurity": "bool",
    "enableRateLimiting": "bool",
    "ipsecPolicies": [
      {
        "dhGroup": "string",
        "ikeEncryption": "string",
        "ikeIntegrity": "string",
        "ipsecEncryption": "string",
        "ipsecIntegrity": "string",
        "pfsGroup": "string",
        "saDataSizeKilobytes": "int",
        "saLifeTimeSeconds": "int"
      }
    ],
    "remoteVpnSite": {
      "id": "string"
    },
    "routingConfiguration": {
      "associatedRouteTable": {
        "id": "string"
      },
      "propagatedRouteTables": {
        "ids": [
          {
            "id": "string"
          }
        ],
        "labels": [ "string" ]
      },
      "vnetRoutes": {
        "staticRoutes": [
          {
            "addressPrefixes": [ "string" ],
            "name": "string",
            "nextHopIpAddress": "string"
          }
        ]
      }
    },
    "routingWeight": "int",
    "sharedKey": "string",
    "useLocalAzureIpAddress": "bool",
    "usePolicyBasedTrafficSelectors": "bool",
    "vpnConnectionProtocolType": "string",
    "vpnLinkConnections": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "connectionBandwidth": "int",
          "egressNatRules": [
            {
              "id": "string"
            }
          ],
          "enableBgp": "bool",
          "enableRateLimiting": "bool",
          "ingressNatRules": [
            {
              "id": "string"
            }
          ],
          "ipsecPolicies": [
            {
              "dhGroup": "string",
              "ikeEncryption": "string",
              "ikeIntegrity": "string",
              "ipsecEncryption": "string",
              "ipsecIntegrity": "string",
              "pfsGroup": "string",
              "saDataSizeKilobytes": "int",
              "saLifeTimeSeconds": "int"
            }
          ],
          "routingWeight": "int",
          "sharedKey": "string",
          "useLocalAzureIpAddress": "bool",
          "usePolicyBasedTrafficSelectors": "bool",
          "vpnConnectionProtocolType": "string",
          "vpnLinkConnectionMode": "string",
          "vpnSiteLink": {
            "id": "string"
          }
        }
      }
    ]
  }
}

Property values

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways/vpnConnections

Name	Description	Value
apiVersion	The api version	'2020-08-01'
name	The resource name	string (required)
properties	Properties of the VPN connection.	VpnConnectionProperties
type	The resource type	'Microsoft.Network/vpnGateways/vpnConnections'

PropagatedRouteTable

Name	Description	Value
ids	The list of resource ids of all the RouteTables.	SubResource[]
labels	The list of labels.	string[]

RoutingConfiguration

Name	Description	Value
associatedRouteTable	The resource id RouteTable associated with this RoutingConfiguration.	SubResource
propagatedRouteTables	The list of RouteTables to advertise the routes to.	PropagatedRouteTable
vnetRoutes	List of routes that control routing from VirtualHub into a virtual network connection.	VnetRoute

StaticRoute

Name	Description	Value
addressPrefixes	List of all address prefixes.	string[]
name	The name of the StaticRoute that is unique within a VnetRoute.	string
nextHopIpAddress	The ip address of the next hop.	string

SubResource

Name	Description	Value
id	Resource ID.	string

VnetRoute

Name	Description	Value
staticRoutes	List of all Static Routes.	StaticRoute[]

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
dpdTimeoutSeconds	DPD timeout in seconds for vpn connection.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingConfiguration	The Routing Configuration indicating the associated and propagated route tables on this connection.	RoutingConfiguration
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
egressNatRules	List of egress NatRules.	SubResource[]
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ingressNatRules	List of ingress NatRules.	SubResource[]
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnectionMode	Vpn link connection mode.	'Default' 'InitiatorOnly' 'ResponderOnly'
vpnSiteLink	Id of the connected vpn site link.	SubResource

Terraform (AzAPI provider) resource definition

The vpnGateways/vpnConnections resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways/vpnConnections resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Network/vpnGateways/vpnConnections@2020-08-01"
  name = "string"
  body = jsonencode({
    properties = {
      connectionBandwidth = int
      dpdTimeoutSeconds = int
      enableBgp = bool
      enableInternetSecurity = bool
      enableRateLimiting = bool
      ipsecPolicies = [
        {
          dhGroup = "string"
          ikeEncryption = "string"
          ikeIntegrity = "string"
          ipsecEncryption = "string"
          ipsecIntegrity = "string"
          pfsGroup = "string"
          saDataSizeKilobytes = int
          saLifeTimeSeconds = int
        }
      ]
      remoteVpnSite = {
        id = "string"
      }
      routingConfiguration = {
        associatedRouteTable = {
          id = "string"
        }
        propagatedRouteTables = {
          ids = [
            {
              id = "string"
            }
          ]
          labels = [
            "string"
          ]
        }
        vnetRoutes = {
          staticRoutes = [
            {
              addressPrefixes = [
                "string"
              ]
              name = "string"
              nextHopIpAddress = "string"
            }
          ]
        }
      }
      routingWeight = int
      sharedKey = "string"
      useLocalAzureIpAddress = bool
      usePolicyBasedTrafficSelectors = bool
      vpnConnectionProtocolType = "string"
      vpnLinkConnections = [
        {
          id = "string"
          name = "string"
          properties = {
            connectionBandwidth = int
            egressNatRules = [
              {
                id = "string"
              }
            ]
            enableBgp = bool
            enableRateLimiting = bool
            ingressNatRules = [
              {
                id = "string"
              }
            ]
            ipsecPolicies = [
              {
                dhGroup = "string"
                ikeEncryption = "string"
                ikeIntegrity = "string"
                ipsecEncryption = "string"
                ipsecIntegrity = "string"
                pfsGroup = "string"
                saDataSizeKilobytes = int
                saLifeTimeSeconds = int
              }
            ]
            routingWeight = int
            sharedKey = "string"
            useLocalAzureIpAddress = bool
            usePolicyBasedTrafficSelectors = bool
            vpnConnectionProtocolType = "string"
            vpnLinkConnectionMode = "string"
            vpnSiteLink = {
              id = "string"
            }
          }
        }
      ]
    }
  })
}

Property values

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways/vpnConnections

Name	Description	Value
name	The resource name	string (required)
parent_id	The ID of the resource that is the parent for this resource.	ID for resource of type: vpnGateways
properties	Properties of the VPN connection.	VpnConnectionProperties
type	The resource type	"Microsoft.Network/vpnGateways/vpnConnections@2020-08-01"

PropagatedRouteTable

Name	Description	Value
ids	The list of resource ids of all the RouteTables.	SubResource[]
labels	The list of labels.	string[]

RoutingConfiguration

Name	Description	Value
associatedRouteTable	The resource id RouteTable associated with this RoutingConfiguration.	SubResource
propagatedRouteTables	The list of RouteTables to advertise the routes to.	PropagatedRouteTable
vnetRoutes	List of routes that control routing from VirtualHub into a virtual network connection.	VnetRoute

StaticRoute

Name	Description	Value
addressPrefixes	List of all address prefixes.	string[]
name	The name of the StaticRoute that is unique within a VnetRoute.	string
nextHopIpAddress	The ip address of the next hop.	string

SubResource

Name	Description	Value
id	Resource ID.	string

VnetRoute

Name	Description	Value
staticRoutes	List of all Static Routes.	StaticRoute[]

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
dpdTimeoutSeconds	DPD timeout in seconds for vpn connection.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingConfiguration	The Routing Configuration indicating the associated and propagated route tables on this connection.	RoutingConfiguration
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
egressNatRules	List of egress NatRules.	SubResource[]
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ingressNatRules	List of ingress NatRules.	SubResource[]
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnectionMode	Vpn link connection mode.	'Default' 'InitiatorOnly' 'ResponderOnly'
vpnSiteLink	Id of the connected vpn site link.	SubResource