Microsoft.Network vpnGateways 2019-09-01

• Latest
• 2024-03-01
• 2024-01-01
• 2023-11-01
• 2023-09-01
• 2023-06-01
• 2023-05-01
• 2023-04-01
• 2023-02-01
• 2022-11-01
• 2022-09-01
• 2022-07-01
• 2022-05-01
• 2022-01-01
• 2021-08-01
• 2021-05-01
• 2021-03-01
• 2021-02-01
• 2020-11-01
• 2020-08-01
• 2020-07-01
• 2020-06-01
• 2020-05-01
• 2020-04-01
• 2020-03-01
• 2019-12-01
• 2019-11-01
• 2019-09-01
• 2019-08-01
• 2019-07-01
• 2019-06-01
• 2019-04-01
• 2019-02-01
• 2018-12-01
• 2018-11-01
• 2018-10-01
• 2018-08-01
• 2018-07-01
• 2018-06-01
• 2018-04-01

Bicep resource definition

The vpnGateways resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Network/vpnGateways@2019-09-01' = {
  location: 'string'
  name: 'string'
  properties: {
    bgpSettings: {
      asn: int
      bgpPeeringAddress: 'string'
      peerWeight: int
    }
    connections: [
      {
        id: 'string'
        name: 'string'
        properties: {
          connectionBandwidth: int
          enableBgp: bool
          enableInternetSecurity: bool
          enableRateLimiting: bool
          ipsecPolicies: [
            {
              dhGroup: 'string'
              ikeEncryption: 'string'
              ikeIntegrity: 'string'
              ipsecEncryption: 'string'
              ipsecIntegrity: 'string'
              pfsGroup: 'string'
              saDataSizeKilobytes: int
              saLifeTimeSeconds: int
            }
          ]
          remoteVpnSite: {
            id: 'string'
          }
          routingWeight: int
          sharedKey: 'string'
          useLocalAzureIpAddress: bool
          usePolicyBasedTrafficSelectors: bool
          vpnConnectionProtocolType: 'string'
          vpnLinkConnections: [
            {
              id: 'string'
              name: 'string'
              properties: {
                connectionBandwidth: int
                enableBgp: bool
                enableRateLimiting: bool
                ipsecPolicies: [
                  {
                    dhGroup: 'string'
                    ikeEncryption: 'string'
                    ikeIntegrity: 'string'
                    ipsecEncryption: 'string'
                    ipsecIntegrity: 'string'
                    pfsGroup: 'string'
                    saDataSizeKilobytes: int
                    saLifeTimeSeconds: int
                  }
                ]
                routingWeight: int
                sharedKey: 'string'
                useLocalAzureIpAddress: bool
                usePolicyBasedTrafficSelectors: bool
                vpnConnectionProtocolType: 'string'
                vpnSiteLink: {
                  id: 'string'
                }
              }
            }
          ]
        }
      }
    ]
    virtualHub: {
      id: 'string'
    }
    vpnGatewayScaleUnit: int
  }
  tags: {
    {customized property}: 'string'
  }
}

Property values

BgpSettings

Name	Description	Value
asn	The BGP speaker's ASN.	int
bgpPeeringAddress	The BGP peering address and BGP identifier of this BGP speaker.	string
peerWeight	The weight added to routes learned from this BGP speaker.	int

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways

Name	Description	Value
location	Resource location.	string
name	The resource name	string (required)
properties	Properties of the VPN gateway.	VpnGatewayProperties
tags	Resource tags	Dictionary of tag names and values. See Tags in templates

ResourceTags

Name	Description	Value

SubResource

Name	Description	Value
id	Resource ID.	string

VpnConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN connection.	VpnConnectionProperties

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnGatewayProperties

Name	Description	Value
bgpSettings	Local network gateway's BGP speaker settings.	BgpSettings
connections	List of all vpn connections to the gateway.	VpnConnection[]
virtualHub	The VirtualHub to which the gateway belongs.	SubResource
vpnGatewayScaleUnit	The scale unit for this vpn gateway.	int

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnSiteLink	Id of the connected vpn site link.	SubResource

Quickstart samples

The following quickstart samples deploy this resource type.

Bicep File	Description
Creates Virtual WAN resources	This template allows you to create virtual WAN resources including Virtual WAN, Virtual Hub, VPN Gateway, VPN Site and a VPN Connecton.

ARM template resource definition

The vpnGateways resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways resource, add the following JSON to your template.

{
  "type": "Microsoft.Network/vpnGateways",
  "apiVersion": "2019-09-01",
  "name": "string",
  "location": "string",
  "properties": {
    "bgpSettings": {
      "asn": "int",
      "bgpPeeringAddress": "string",
      "peerWeight": "int"
    },
    "connections": [
      {
        "id": "string",
        "name": "string",
        "properties": {
          "connectionBandwidth": "int",
          "enableBgp": "bool",
          "enableInternetSecurity": "bool",
          "enableRateLimiting": "bool",
          "ipsecPolicies": [
            {
              "dhGroup": "string",
              "ikeEncryption": "string",
              "ikeIntegrity": "string",
              "ipsecEncryption": "string",
              "ipsecIntegrity": "string",
              "pfsGroup": "string",
              "saDataSizeKilobytes": "int",
              "saLifeTimeSeconds": "int"
            }
          ],
          "remoteVpnSite": {
            "id": "string"
          },
          "routingWeight": "int",
          "sharedKey": "string",
          "useLocalAzureIpAddress": "bool",
          "usePolicyBasedTrafficSelectors": "bool",
          "vpnConnectionProtocolType": "string",
          "vpnLinkConnections": [
            {
              "id": "string",
              "name": "string",
              "properties": {
                "connectionBandwidth": "int",
                "enableBgp": "bool",
                "enableRateLimiting": "bool",
                "ipsecPolicies": [
                  {
                    "dhGroup": "string",
                    "ikeEncryption": "string",
                    "ikeIntegrity": "string",
                    "ipsecEncryption": "string",
                    "ipsecIntegrity": "string",
                    "pfsGroup": "string",
                    "saDataSizeKilobytes": "int",
                    "saLifeTimeSeconds": "int"
                  }
                ],
                "routingWeight": "int",
                "sharedKey": "string",
                "useLocalAzureIpAddress": "bool",
                "usePolicyBasedTrafficSelectors": "bool",
                "vpnConnectionProtocolType": "string",
                "vpnSiteLink": {
                  "id": "string"
                }
              }
            }
          ]
        }
      }
    ],
    "virtualHub": {
      "id": "string"
    },
    "vpnGatewayScaleUnit": "int"
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property values

BgpSettings

Name	Description	Value
asn	The BGP speaker's ASN.	int
bgpPeeringAddress	The BGP peering address and BGP identifier of this BGP speaker.	string
peerWeight	The weight added to routes learned from this BGP speaker.	int

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways

Name	Description	Value
apiVersion	The api version	'2019-09-01'
location	Resource location.	string
name	The resource name	string (required)
properties	Properties of the VPN gateway.	VpnGatewayProperties
tags	Resource tags	Dictionary of tag names and values. See Tags in templates
type	The resource type	'Microsoft.Network/vpnGateways'

ResourceTags

Name	Description	Value

SubResource

Name	Description	Value
id	Resource ID.	string

VpnConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN connection.	VpnConnectionProperties

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnGatewayProperties

Name	Description	Value
bgpSettings	Local network gateway's BGP speaker settings.	BgpSettings
connections	List of all vpn connections to the gateway.	VpnConnection[]
virtualHub	The VirtualHub to which the gateway belongs.	SubResource
vpnGatewayScaleUnit	The scale unit for this vpn gateway.	int

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnSiteLink	Id of the connected vpn site link.	SubResource

Quickstart templates

The following quickstart templates deploy this resource type.

Template	Description
Azure Virtual WAN (vWAN) Multi-Hub Deployment	This template allows you to create an Azure Virtual WAN (vWAN) multi-hub deployment including all gateways and VNET connections.
Azure vWAN Multi-Hub Deployment with Custom Routing Tables	This template allows you to create an Azure Virtual WAN (vWAN) multi-hub deployment, including all gateways and VNET connections, and demonstrate the usage of Route Tables for custom routing.
Creates Virtual WAN resources	This template allows you to create virtual WAN resources including Virtual WAN, Virtual Hub, VPN Gateway, VPN Site and a VPN Connecton.

Terraform (AzAPI provider) resource definition

The vpnGateways resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Network/vpnGateways resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Network/vpnGateways@2019-09-01"
  name = "string"
  location = "string"
  body = jsonencode({
    properties = {
      bgpSettings = {
        asn = int
        bgpPeeringAddress = "string"
        peerWeight = int
      }
      connections = [
        {
          id = "string"
          name = "string"
          properties = {
            connectionBandwidth = int
            enableBgp = bool
            enableInternetSecurity = bool
            enableRateLimiting = bool
            ipsecPolicies = [
              {
                dhGroup = "string"
                ikeEncryption = "string"
                ikeIntegrity = "string"
                ipsecEncryption = "string"
                ipsecIntegrity = "string"
                pfsGroup = "string"
                saDataSizeKilobytes = int
                saLifeTimeSeconds = int
              }
            ]
            remoteVpnSite = {
              id = "string"
            }
            routingWeight = int
            sharedKey = "string"
            useLocalAzureIpAddress = bool
            usePolicyBasedTrafficSelectors = bool
            vpnConnectionProtocolType = "string"
            vpnLinkConnections = [
              {
                id = "string"
                name = "string"
                properties = {
                  connectionBandwidth = int
                  enableBgp = bool
                  enableRateLimiting = bool
                  ipsecPolicies = [
                    {
                      dhGroup = "string"
                      ikeEncryption = "string"
                      ikeIntegrity = "string"
                      ipsecEncryption = "string"
                      ipsecIntegrity = "string"
                      pfsGroup = "string"
                      saDataSizeKilobytes = int
                      saLifeTimeSeconds = int
                    }
                  ]
                  routingWeight = int
                  sharedKey = "string"
                  useLocalAzureIpAddress = bool
                  usePolicyBasedTrafficSelectors = bool
                  vpnConnectionProtocolType = "string"
                  vpnSiteLink = {
                    id = "string"
                  }
                }
              }
            ]
          }
        }
      ]
      virtualHub = {
        id = "string"
      }
      vpnGatewayScaleUnit = int
    }
  })
  tags = {
    {customized property} = "string"
  }
}

Property values

BgpSettings

Name	Description	Value
asn	The BGP speaker's ASN.	int
bgpPeeringAddress	The BGP peering address and BGP identifier of this BGP speaker.	string
peerWeight	The weight added to routes learned from this BGP speaker.	int

IpsecPolicy

Name	Description	Value
dhGroup	The DH Group used in IKE Phase 1 for initial SA.	'DHGroup1' 'DHGroup14' 'DHGroup2' 'DHGroup2048' 'DHGroup24' 'ECP256' 'ECP384' 'None' (required)
ikeEncryption	The IKE encryption algorithm (IKE phase 2).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES256' (required)
ikeIntegrity	The IKE integrity algorithm (IKE phase 2).	'GCMAES128' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' 'SHA384' (required)
ipsecEncryption	The IPSec encryption algorithm (IKE phase 1).	'AES128' 'AES192' 'AES256' 'DES' 'DES3' 'GCMAES128' 'GCMAES192' 'GCMAES256' 'None' (required)
ipsecIntegrity	The IPSec integrity algorithm (IKE phase 1).	'GCMAES128' 'GCMAES192' 'GCMAES256' 'MD5' 'SHA1' 'SHA256' (required)
pfsGroup	The Pfs Group used in IKE Phase 2 for new child SA.	'ECP256' 'ECP384' 'None' 'PFS1' 'PFS14' 'PFS2' 'PFS2048' 'PFS24' 'PFSMM' (required)
saDataSizeKilobytes	The IPSec Security Association (also called Quick Mode or Phase 2 SA) payload size in KB for a site to site VPN tunnel.	int (required)
saLifeTimeSeconds	The IPSec Security Association (also called Quick Mode or Phase 2 SA) lifetime in seconds for a site to site VPN tunnel.	int (required)

Microsoft.Network/vpnGateways

Name	Description	Value
location	Resource location.	string
name	The resource name	string (required)
properties	Properties of the VPN gateway.	VpnGatewayProperties
tags	Resource tags	Dictionary of tag names and values.
type	The resource type	"Microsoft.Network/vpnGateways@2019-09-01"

ResourceTags

Name	Description	Value

SubResource

Name	Description	Value
id	Resource ID.	string

VpnConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN connection.	VpnConnectionProperties

VpnConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableInternetSecurity	Enable internet security.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
remoteVpnSite	Id of the connected vpn site.	SubResource
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnLinkConnections	List of all vpn site link connections to the gateway.	VpnSiteLinkConnection[]

VpnGatewayProperties

Name	Description	Value
bgpSettings	Local network gateway's BGP speaker settings.	BgpSettings
connections	List of all vpn connections to the gateway.	VpnConnection[]
virtualHub	The VirtualHub to which the gateway belongs.	SubResource
vpnGatewayScaleUnit	The scale unit for this vpn gateway.	int

VpnSiteLinkConnection

Name	Description	Value
id	Resource ID.	string
name	The name of the resource that is unique within a resource group. This name can be used to access the resource.	string
properties	Properties of the VPN site link connection.	VpnSiteLinkConnectionProperties

VpnSiteLinkConnectionProperties

Name	Description	Value
connectionBandwidth	Expected bandwidth in MBPS.	int
enableBgp	EnableBgp flag.	bool
enableRateLimiting	EnableBgp flag.	bool
ipsecPolicies	The IPSec Policies to be considered by this connection.	IpsecPolicy[]
routingWeight	Routing weight for vpn connection.	int
sharedKey	SharedKey for the vpn connection.	string
useLocalAzureIpAddress	Use local azure ip to initiate connection.	bool
usePolicyBasedTrafficSelectors	Enable policy-based traffic selectors.	bool
vpnConnectionProtocolType	Connection protocol used for this connection.	'IKEv1' 'IKEv2'
vpnSiteLink	Id of the connected vpn site link.	SubResource