Create a VPN gateway using PowerShell

  • Article

This article helps you create an Azure VPN gateway using PowerShell. A VPN gateway is used when creating a VPN connection to your on-premises network. You can also use a VPN gateway to connect VNets. For more comprehensive information about some of the settings in this article, see Create a VPN gateway - portal.

Diagram that shows a virtual network and a VPN gateway.

A VPN gateway is one part of a connection architecture to help you securely access resources within a virtual network.

  • The left side of the diagram shows the virtual network and the VPN gateway that you create by using the steps in this article.
  • You can later add different types of connections, as shown on the right side of the diagram. For example, you can create site-to-site and point-to-site connections. To view different design architectures that you can build, see VPN gateway design.

The steps in this article create a virtual network, a subnet, a gateway subnet, and a route-based, zone-redundant active-active VPN gateway (virtual network gateway) using the Generation 2 VpnGw2AZ SKU. If you want to create a VPN gateway using the Basic SKU instead, see Create a Basic SKU VPN gateway. Once the gateway creation completes, you can then create connections.

Active-active gateways differ from active-standby gateways in the following ways:

  • Active-active gateways have two Gateway IP configurations and two public IP addresses.
  • Active-active gateways have active-active setting enabled.
  • The virtual network gateway SKU can't be Basic or Standard.

For more information about active-active gateways, see Highly Available cross-premises and VNet-to-VNet connectivity. For more information about availability zones and zone redundant gateways, see What are availability zones?

Before you begin

These steps require an Azure subscription. If you don't have an Azure subscription, create a Trial before you begin.

Working with Azure PowerShell

You can install and run the Azure PowerShell cmdlets locally on your computer. PowerShell cmdlets are updated frequently. If you haven't installed the latest version, the values specified in the instructions may fail. To find the versions of Azure PowerShell installed on your computer, use the Get-Module -ListAvailable Az cmdlet. To install or update, see Install the Azure PowerShell module.

Create a resource group

Create an Azure resource group with New-AzResourceGroup. A resource group is a logical container into which Azure resources are deployed and managed. Open your PowerShell console with elevated privileges and connect to Azure using the Connect-AzAccount -Environment AzureChinaCloud command.

New-AzResourceGroup -Name TestRG1 -Location ChinaNorth3

Create a virtual network

Create a virtual network with New-AzVirtualNetwork. The following example creates a virtual network named VNet1 in the ChinaNorth3 location:

$virtualnetwork = New-AzVirtualNetwork `
  -ResourceGroupName TestRG1 `
  -Location ChinaNorth3 `
  -Name VNet1 `
  -AddressPrefix 10.1.0.0/16

Create a subnet configuration using the New-AzVirtualNetworkSubnetConfig cmdlet.

$subnetConfig = Add-AzVirtualNetworkSubnetConfig `
  -Name Frontend `
  -AddressPrefix 10.1.0.0/24 `
  -VirtualNetwork $virtualnetwork

Set the subnet configuration for the virtual network using the Set-AzVirtualNetwork cmdlet.

$virtualnetwork | Set-AzVirtualNetwork

Add a gateway subnet

The gateway subnet contains the reserved IP addresses that the virtual network gateway services use. Use the following examples to add a gateway subnet:

Set a variable for your virtual network.

$vnet = Get-AzVirtualNetwork -ResourceGroupName TestRG1 -Name VNet1

Create the gateway subnet using the Add-AzVirtualNetworkSubnetConfig cmdlet.

Add-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -AddressPrefix 10.1.255.0/27 -VirtualNetwork $vnet

Set the subnet configuration for the virtual network using the Set-AzVirtualNetwork cmdlet.

$vnet | Set-AzVirtualNetwork

Request a public IP address

Each VPN gateway must have an allocated public IP address. When you create a connection to a VPN gateway, this is the IP address that you specify. In this exercise, we create an active-active zone-redundant VPN gateway environment. That means that two Standard public IP addresses are required, one for each gateway, and we must also specify the Zone setting. This example specifies a zone-redundant configuration because it specifies all 3 regional zones.

Use the following examples to request a public IP address for each gateway. The allocation method must be Static.

$gw1pip1 = New-AzPublicIpAddress -Name "VNet1GWpip1" -ResourceGroupName "TestRG1" -Location "ChinaNorth3" -AllocationMethod Static -Sku Standard -Zone 1,2,3

$gw1pip2 = New-AzPublicIpAddress -Name "VNet1GWpip2" -ResourceGroupName "TestRG1" -Location "ChinaNorth3" -AllocationMethod Static -Sku Standard -Zone 1,2,3

Create the gateway IP address configuration

The gateway configuration defines the subnet and the public IP address to use. Use the following example to create your gateway configuration.

$vnet = Get-AzVirtualNetwork -Name VNet1 -ResourceGroupName TestRG1
$subnet = Get-AzVirtualNetworkSubnetConfig -Name 'GatewaySubnet' -VirtualNetwork $vnet

$gwipconfig1 = New-AzVirtualNetworkGatewayIpConfig -Name gwipconfig1 -SubnetId $subnet.Id -PublicIpAddressId $gw1pip1.Id
$gwipconfig2 = New-AzVirtualNetworkGatewayIpConfig -Name gwipconfig2 -SubnetId $subnet.Id -PublicIpAddressId $gw1pip2.Id

Create the VPN gateway

Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. Once the gateway is created, you can create a connection between your virtual network and another virtual network. Or, create a connection between your virtual network and an on-premises location.

Create a VPN gateway using the New-AzVirtualNetworkGateway cmdlet. Notice in the examples that both public IP addresses are referenced and the gateway is configured as active-active. In the example, we add the optional -Debug switch.

New-AzVirtualNetworkGateway -Name VNet1GW -ResourceGroupName TestRG1 `
-Location "ChinaNorth3" -IpConfigurations $gwipconfig1,$gwipconfig2 -GatewayType "Vpn" -VpnType RouteBased `
-GatewaySku VpnGw2AZ -VpnGatewayGeneration Generation2 -EnableActiveActiveFeature -Debug

View the VPN gateway

You can view the VPN gateway using the Get-AzVirtualNetworkGateway cmdlet.

Get-AzVirtualNetworkGateway -Name Vnet1GW -ResourceGroup TestRG1

View the public IP addresses

To view the public IP address for your VPN gateway, use the Get-AzPublicIpAddress cmdlet. Example:

Get-AzPublicIpAddress -Name VNet1GWpip1 -ResourceGroupName TestRG1

Clean up resources

When you no longer need the resources you created, use the Remove-AzResourceGroup command to delete the resource group. This deletes the resource group and all of the resources it contains.

Remove-AzResourceGroup -Name TestRG1

Next steps

Once the gateway has finished creating, you can create a connection between your virtual network and another virtual network. Or, create a connection between your virtual network and an on-premises location.