Hello Everyone, I am new to Azure and going through the Azure S2S, P2S and Express Route connections. I am thrilled to perform a Lab on configuring a S2S VPN. Can anyone suggest me the steps or procedure on how to configure the S2S VPN connection without having the On-Premises. This is entirely for a lab scenario. Thank You, RV

@Raja Sheker Vuttham Thank you for reaching out.In order to create a S2S connection without the on-prem you can create Vnet-VNet VPN connection as shown here Configuring a VNet-to-VNet connection is a simple way to connect VNets. When you connect a virtual network to another virtual network with a VNet-to-VNet connection type (VNet2VNet), it's similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connection types use a VPN gateway to provide a secure tunnel with IPsec/IKE and function the same way when communicating. However, they differ in the way the local network gateway is configured. Hope this helps! Please let me know if you have any additional questions. Thank you! Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Need to configure a S2S vpn in azure without the On-premises (Lab purpose)

Accepted answer

ChaitanyaNaykodi-MSFT 26,201 Reputation points Microsoft Employee

2024-07-11T15:48:15.4066667+00:00

@Raja Sheker Vuttham

Thank you for reaching out.In order to create a S2S connection without the on-prem you can create Vnet-VNet VPN connection as shown here

Configuring a VNet-to-VNet connection is a simple way to connect VNets. When you connect a virtual network to another virtual network with a VNet-to-VNet connection type (VNet2VNet), it's similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connection types use a VPN gateway to provide a secure tunnel with IPsec/IKE and function the same way when communicating. However, they differ in the way the local network gateway is configured.

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Raja Sheker Vuttham 20 Reputation points

2024-07-12T04:28:30.81+00:00

Hello ChaitanyaNaykodi-MSFT,

I accept the answer and perform the lab once as per the instructions. Can you please clarify one doubt, whether or not can we implement any routing in between?

Thank You,

RV

ChaitanyaNaykodi-MSFT 26,201 Reputation points Microsoft Employee

2024-07-12T20:20:57.8766667+00:00

@Raja Sheker Vuttham

Yes, you can implement various routing scenarios in the set-up above like creating VM's in the both the Vnets and testing the traffic flow or Peering spoke Vnets to test transitive traffic flow.

You can use this implementation as a reference here where you can designate one Vnet as on-prem and test the connectivity and traffic flow.

Additional reference for routing scenarios
https://zcusa.951200.xyz/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing#multis2s

Thanks

Raja Sheker Vuttham 20 Reputation points

2024-07-13T17:00:19.46+00:00

@chaitanyaNaykoda

I have implemented the scenario:
a. Configured the VNet's in two different regions under the same Subscription.
b. Configured the Virtual Network Gateway for both the Vnets and allowed the peerings.
c. Configured the Virtual Machines for both the Vnets.
d. Configured the Routes and also allowed then using the NSG. Allowed Inbound and Outbound traffic.
e. I was successfully able to ping the virtual gateway IP but couldn't ping the Private IP of the VM.
f. Test-NetConnection <IP> -Port 3389 -- Output came as TRUE.
g. Allowed ICMP also but couldn't do a ping.

I think I have forgot to delete the default "Deny Inbound traffic" in the NSG. Please share few more points.
Also, tried pathping but the output was not upto the mark as the ping was not reaching the VM2 Private IP from VM1 Azure Bastion.

Thank You.

RV

ChaitanyaNaykodi-MSFT 26,201 Reputation points Microsoft Employee

2024-07-16T23:31:56.1833333+00:00

@Raja Sheker Vuttham

You can use IP flow verify to test if any NSG is blocking the connectivity. ICMP traffic needs to be allowed in NSG for both inbound and outbound connection and VM OS also needs to allow ICMP communication.

Hope this helps. Thanks
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Need to configure a S2S vpn in azure without the On-premises (Lab purpose)

0 additional answers

Your answer