2.1 Site-to-Site (S2S) VPN Connectivity
📘Microsoft Azure Networking Solutions (AZ-700)
1. What is an IPsec/IKE Policy?
An IPsec/IKE policy defines how security is applied to a Site-to-Site VPN connection between Azure and an on-premises network.
In simple terms, the policy answers these questions:
- Which encryption methods are used?
- Which hashing (integrity) methods are used?
- Which security protocol versions are used?
- How often are security keys refreshed?
Azure and the on-premises VPN device must use the same policy settings, or the VPN connection will fail.
2. Why IPsec/IKE Policy Matters for the Exam
For AZ-700, you must understand:
- When default policy is used
- When custom IPsec/IKE policy is required
- What parameters make up the policy
- Where the policy is configured in Azure
- How policy mismatches affect VPN connectivity
3. Default vs Custom IPsec/IKE Policy
Default Policy
Azure automatically applies a default IPsec/IKE policy if:
- No custom policy is defined
- The on-premises VPN device supports Azure defaults
Default policy is usually sufficient for:
- Modern VPN devices
- Standard security requirements
Custom IPsec/IKE Policy
A custom policy is required when:
- The on-premises VPN device uses specific security settings
- Legacy devices require older algorithms
- Compliance requires stronger encryption
In exam questions:
If a VPN connection fails due to parameter mismatch, custom IPsec/IKE policy is the correct solution.
4. Where IPsec/IKE Policy is Configured in Azure
An IPsec/IKE policy is configured on:
- Site-to-Site VPN connection
- VNet-to-VNet VPN connection
It is NOT configured on:
- Virtual Network Gateway
- Local Network Gateway
5. IKE Versions Explained
Azure supports IKEv1 and IKEv2.
| Version | Description |
|---|---|
| IKEv1 | Older, less secure |
| IKEv2 | More secure, recommended |
Exam Tip:
- IKEv2 is preferred
- Use IKEv1 only if required by on-premises device
6. IPsec and IKE Phases
VPN security uses two phases:
Phase 1 (IKE Phase)
- Establishes a secure management channel
- Handles authentication and key exchange
Phase 2 (IPsec Phase)
- Encrypts actual data traffic
- Uses the keys created in Phase 1
7. IPsec/IKE Policy Parameters (VERY IMPORTANT FOR EXAM)
7.1 IKE Phase (Phase 1) Parameters
| Parameter | Purpose |
|---|---|
| IKE Encryption | Encrypts IKE negotiation |
| IKE Integrity | Ensures data is not modified |
| DH Group | Secure key exchange |
| IKE Version | IKEv1 or IKEv2 |
Common Values:
- Encryption: AES256
- Integrity: SHA256
- DH Group: DHGroup14 or higher
7.2 IPsec Phase (Phase 2) Parameters
| Parameter | Purpose |
|---|---|
| IPsec Encryption | Encrypts actual data |
| IPsec Integrity | Data integrity check |
| PFS Group | Extra security for key generation |
| SA Lifetime | How long keys are valid |
Common Values:
- Encryption: AES256
- Integrity: SHA256
- PFS: PFS2 / PFS14
- SA Lifetime: 3600 seconds
8. Diffie-Hellman (DH) and PFS Explained Simply
Diffie-Hellman (DH)
- Used in Phase 1
- Securely generates encryption keys
- Higher DH group = stronger security
Perfect Forward Secrecy (PFS)
- Used in Phase 2
- Ensures each session uses new keys
- Protects past data if a key is compromised
9. Security Association (SA) Lifetime
SA Lifetime defines:
- How long encryption keys remain valid
- When keys must be regenerated
Two lifetimes exist:
- IKE SA Lifetime
- IPsec SA Lifetime
Shorter lifetime = higher security, more CPU usage
10. Common Exam Scenarios
Scenario 1: VPN Connection Fails
Possible causes:
- Encryption mismatch
- Integrity algorithm mismatch
- DH or PFS group mismatch
- IKE version mismatch
Solution: Configure a custom IPsec/IKE policy
Scenario 2: Legacy VPN Device
- Device does not support Azure default policy
- Requires specific encryption or DH group
Solution: Create a custom IPsec/IKE policy
Scenario 3: Compliance Requirements
- Organization mandates AES256, SHA256
- Strong key exchange required
Solution: Configure custom IPsec/IKE policy with required parameters
11. Azure PowerShell / CLI (Exam Awareness Only)
You do not need to memorize commands, but understand that:
- IPsec/IKE policy can be created using PowerShell or Azure CLI
- Policy is attached to the VPN connection object
12. Key Exam Takeaways (VERY IMPORTANT)
- IPsec/IKE policy controls VPN security parameters
- Default policy works for most scenarios
- Custom policy is required for:
- Legacy devices
- Security compliance
- Connection failures due to mismatch
- Policy is applied to:
- Site-to-Site VPN connection
- Azure supports:
- IKEv1 and IKEv2
- Understand:
- Encryption
- Integrity
- DH Group
- PFS
- SA Lifetime
13. One-Line Exam Summary
An IPsec/IKE policy defines the encryption, integrity, key exchange, and lifetime settings used to secure a Site-to-Site VPN connection in Azure, and must match the on-premises VPN device configuration.
