Azure VPN: VPN configuration example (Azure site-to-site VPN connection)

This page provides more specific values for configuring a VPN connection between Kyndryl Cloud Uplift and an Azure VPN. It contains sample VPN configuration parameters to enter on the Kyndryl Cloud Uplift VPN page, as well as the configuration values to enter in your Azure account.

For general information about the configuration process for each side of the VPN connection, first see:

Contents

Sample VPN configuration

In the Azure portal:

  1. Follow the instructions at Create a Site-to-Site connection in the Azure portal.

    • During the Create the VPN gateway step, select VPN type: Route-based.

    • During the Create the local network gateway step, use the following values:

      • IP address: Enter the static public IP address that is (or will be) associated with your Kyndryl Cloud Uplift VPN. This is either automatically assigned when you click Create VPN in Kyndryl Cloud Uplift, or you can manually select from the available static public IP addresses in your Kyndryl Cloud Uplift account.
      • Address space: Enter the subnet range for the IP addresses you want to access in your Kyndryl Cloud Uplift account. This value must match the Kyndryl Cloud Uplift subnet range defined in your Kyndryl Cloud Uplift VPN configuration.
    • In the Configure your VPN device step, note the public IP address of your virtual network gateway.

  2. Download a VPN device configuration script. For example, select one of the Juniper device files.

Kyndryl Cloud Uplift VPN configuration

Parameters to enter on your Kyndryl Cloud Uplift VPN page:

Parameter Name

Value to enter

Name

Name for your Kyndryl Cloud Uplift VPN

Example: azure-east-us-vpn

Remote Peer IP

Enter the public IP address of the VPN gateway in your Azure account.

Region

N/A. This is automatically populated when you select a public IP address for the Kyndryl Cloud Uplift peer IP field (see below).

Example: US-East-2

Kyndryl Cloud Uplift peer IP

An available public IP address in your Kyndryl Cloud Uplift account. Select a public IP address in the same region as the VMs you want to connect to.

Example: 199.199.199.199

This value is entered in the IP address field of the local network gateway in your Azure account.

Kyndryl Cloud Uplift subnet

This is the range of VM IP addresses in Kyndryl Cloud Uplift that sends and receives traffic through this VPN. This can’t overlap with the included remote subnets defined below.

This must match the value in the Address space field of the local network gateway in your Azure account.

You can specify the default route (0.0.0.0/0) for either the remote subnet or the local subnet. You can’t use 0.0.0.0/0 for both local and remote subnets.

Apply NAT for Connected Networks

YES

Topology

Route-based

Phase 1 Encryption Algorithm

aes 256

Phase 1 Hash Algorithm

sha1

Phase 1 pre-shared Key

[SHARED SECRET KEY]

This must match the pre-shared key in the Azure VPN connection.

Phase 1 SA lifetime

28800

Phase 1 DH group

modp2048 (14)

Phase 2 encryption algorithm

aes 256

Phase 2 authentication algorithm

hmac_sha1

Phase 2 perfect forward secrecy (PFS)

NO

Phase 2 SA lifetime

3600

SA policy level

require

Specify maximum segment size

YES

Maximum segment size

1350

Dead peer detection

OFF

Included remote subnets

Enter the IP addresses and subnets on your Azure virtual network that will send and receive traffic through this VPN.

Example: 10.1.15.0/24

You can specify the default route (0.0.0.0/0) for either the remote subnet or the local subnet. You can’t use 0.0.0.0/0 for both local and remote subnets.

Excluded remote subnets

Subset of IP addresses and subnets on the Azure virtual network that should be excluded from using the VPN tunnel. This is used only to define exclusions for VPN traffic from larger included remote subnets (defined above).

Example: 10.1.15.17/32

Troubleshooting

If the VPN appears to not be working, try the following:

  • Verify that you have a strong pre-shared key and that it’s correctly entered in both Kyndryl Cloud Uplift and Azure.
  • Verify that the VPN settings in both Kyndryl Cloud Uplift and Azure match the recommended settings above.
  • If you changed any settings in Kyndryl Cloud Uplift or Azure, the Azure VPN gateway won’t use the changed settings until you reset it. For instructions, see Reset a VPN Gateway.

  • In some cases, the Kyndryl Cloud Uplift VPN test will show failures for a correctly configured VPN. Try connecting directly from a Kyndryl Cloud Uplift VM to an Azure VM.

    Make sure both of the VMs are connected to networks attached to the VPN.