Tag: vNET

Move or Add a VM’s Primary NIC from one VNET to another vNet

    In this example, the powershell Cmdlets edit the VM NIC properties and change the subnet from one vNet to another vNet.

    Step1: Get Azure VM, NIC and Resource Group Properties.

    Stop-AzVM -Name “vm” -ResourceGroupName “RG01”

    $vm = Get-AzVm -Name “vm” -ResourceGroupName “RG01”
    $myVnet = Get-AzVirtualNetwork -Name “VNET” -ResourceGroupName “RG01”
    $backEnd = $myVnet.Subnets | ?{$_.Name -eq ‘Prod’}

    # Create a virtual NIC
    $myNic3 = New-AzNetworkInterface -ResourceGroupName “RG01” -Name “vNIC-01” -Location “AustraliaEast” -SubnetId $backEnd.Id

    # Get the ID of the new virtual NIC and add to VM
    $nicId = (Get-AzNetworkInterface -ResourceGroupName “RG01” -Name “vNIC-01”).Id
    Add-AzVMNetworkInterface -VM $vm -Id $nicId | Update-AzVm -ResourceGroupName “RG01”

    Step2 : Setup Values of Target vNet to be applied to the Azure VM

    $vm.NetworkProfile.NetworkInterfaces

    # Set NIC 0 to be primary
    $vm.NetworkProfile.NetworkInterfaces[0].Primary = $true
    $vm.NetworkProfile.NetworkInterfaces[1].Primary = $false

    Step3: Apply the changes. The VM will be restarted once you execute the PowerShell command.

    # Update the VM state in Azure
    Update-AzVM -VM $vm -ResourceGroupName “RG01”

    Start-AzVM -ResourceGroupName “RG01” -Name “vm”

    Step4: Check the properties of the Azure VM.

    Azure Site-to-Site IPSec VPN connection with Citrix NetScaler (CloudBridge)

    An Azure Site-to-Site VPN gateway connection is used to connect on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device located on-premises that has an externally facing public IP address assigned to it.

    In this example, I am going to use Citrix CloudBridge feature of a NetScaler. The Citrix CloudBridge works in a pair, one at each end of a link, to accelerate traffic over the link. The transformations done by the sender are reversed by the receiver. One CB virtual appliance  can handle many links, so you do not have to dedicate a pair to each connection. You need just one CB virtual appliance per site to handle traffic to and from Azure datacenter to on-premises datacenter. In a Citrix CloudBridge Connector tunnel, IPSec ensures:

    • Data integrity
    • Data origin authentication
    • Data confidentiality (encryption)
    • Protection against replay attacks

    The below exercise creates a IPSec tunnel between 66.128.x.x (On-prem) to 168.63.x.x (Azure).

    Basic Requirements:

    • Make sure that the public IPv4 address for your VPN device is not located behind a NAT firewall
    • Make sure you have correct NSG rules are configured for you to access on-premises VM from Azure VM or vise-versa.

    IP Address Requirements:

    IP address of the CloudBridge Connector tunnel end point (CB Appliance) in the on-premises side 66.128.x.x
    IP address of the CloudBridge Connector tunnel end point in the Azure VPN Gateway 168.63.x.x
    Datacenter Subnet, the traffic of which is to traverse the CloudBridge Connector tunnel 10.120.0.0/23
    Azure Subnet, the traffic of which is to traverse the CloudBridge Connector tunnel 10.10.0.0/22

    Citrix NetScaler Settings

    IPSec profile CB_Azure_IPSec_Profile IKE version = v1

    Encryption algorithm = AES

    Hash algorithm = HMAC SHA1
    CloudBridge Connector tunnel CB_Azure_Tunnel Remote IP = 168.63.x.x

    Local IP= 66.128.x.x (SNIP)

    Tunnel protocol = IPSec

    IPSec profile= CB_Azure_IPSec_Profile
    Policy based route CB_Azure_Pbr Source IP range = Subnet in the datacenter =10.120.0.0-10.120.1.254

    Destination IP range =Subnet in Azure =10.10.0.1 – 10.10.3.254

    IP Tunnel = CB_Azure_Tunnel

    Azure VPN Gateway Settings

    Public IP Address of the Azure VPN Gateway 168.63.x.x
    Local Network On-prem Network VPN Device IP address = 66.128.x.x (SNIP)

    On-prem Subnet =10.120.0.0/24
    Virtual Network CloudBridge Tunnel in Azure Side Address Space of the Azure vNET= 10.10.0.0/22

    Trusted Subnet within the vNET = 10.10.0.1/24

    Untrusted Subnet within the vNET = 10.10.1.1/24

    Gateway Subnet=10.10.2.0/24
    Region Australia East
    VPN Type Route-based
    Connection Type Site-to-site (IPsec)
    Gateway Type VPN
    Shared key Sample Shared Key DkiMgMdcbqvYREEuIvxsbKkW0FOyDiLM

    Configuration of Citrix NetScaler CloudBridge Feature

    Step1: Create IPSec Profile

    add ipsec profile CB_Azure_IPSec_Profile –psk  DkiMgMdcbqvYREEuIvxsbKkW0FOyDiLM  -ikeVersion v1 –lifetime 31536000

    Note: DkiMgMdcbqvYREEuIvxsbKkW0FOyDiLM is also used in the Azure VPN connection.

    Step2: Create IPSec Tunnel

    add iptunnel CB_Azure_Tunnel 168.63.x.x 255.255.255.255 66.128.x.x –protocol IPSEC –ipsecProfileName CB_Azure_IPSec_Profile

    Step3: Create PBR Rule

    add pbr CB_Azure_Pbr -srcIP 10.120.0.0-10.120.1.255 –destIP 10.10.0.0-10.10.3.255 –ipTunnelCB_Azure_Tunnel

    Step4: Apply Settings

    apply pbrs

    You can configure NetScaler using GUI as well. here is an example.

    1. Access the configuration utility by using a web browser to connect to the IP address of the NetScaler appliance in the datacenter.
    2. Navigate to System > CloudBridge Connector.
    3. In the right pane, under Getting Started, click Create/Monitor CloudBridge.
    4. Click Get Started> In the CloudBridge Setup pane, click Microsoft Windows Azure.
    5. In the Azure Settings pane, in the Gateway IP Address* field, type the IP address of the Azure gateway. The CloudBridge Connector tunnel is then set up between the NetScaler appliance and the gateway. In the Subnet (IP Range)* text boxes, specify a subnet range (in Azure cloud), the traffic of which is to traverse the CloudBridge Connector tunnel. Click Continue.
    6. In the NetScaler Settings pane, from the Local Subnet IP* drop-down list, select a publicly accessible SNIP address configured on the NetScaler appliance. In Subnet (IP Range)* text boxes, specify a local subnet range, the traffic of which is to traverse the CloudBridge Connector tunnel. Click Continue.
    7. In the CloudBridge Setting pane, in the CloudBridge Name text box, type a name for the CloudBridge that you want to create.
    8. From the Encryption Algorithm and Hash Algorithm drop-down lists, select the AES and HMAC_SHA1 algorithms, respectively. In the Pre Shared Security Key text box, type the security key.
    9. Click Done.

    Configuration of an IPSec Site-to-Site VPN in the Azure Subscription 

    Step1: Connect to Azure Subscription

    Login-AzureRmAccount

    Get-AzureRmSubscription

    Select-AzureRmSubscription -SubscriptionName “99ebd-649c-466a-a670-f1a611841”

    Step2: Create Azure Resource Group in your region

    New-AzureRmResourceGroup -Name TestRG1 -Location “Australia East”

    Step3: Create vNET and Subnets

    $subnet1 = New-AzureRmVirtualNetworkSubnetConfig -Name “Tursted” -AddressPrefix 10.10.0.0/24

    $subnet2 = New-AzureRmVirtualNetworkSubnetConfig -Name “UnTursted” -AddressPrefix 10.10.1.0/24

    $subnet3 = New-AzureRmVirtualNetworkSubnetConfig -Name “GatewaySubnet” -AddressPrefix 10.10.2.0/24

    $vnet=New-AzureRmVirtualNetwork -Name TestVNet1 -ResourceGroupName TestRG1 -Location “Australia East” -AddressPrefix 10.10.0.0/22 -Subnet $subnet1, $subnet2, $subnet3

    Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

    Step4: Create On-premises Network

    New-AzureRmLocalNetworkGateway -Name Site2 -ResourceGroupName TestRG1 -Location “Australia East” -GatewayIpAddress “66.128.x.x” -AddressPrefix “10.120.0.0/24”

    New-AzureRmLocalNetworkGateway -Name Site2 -ResourceGroupName TestRG1 -Location “East US” -GatewayIpAddress “23.99.221.164” -AddressPrefix @(“10.120.0.0/24”,”10.120.1.0/24”)

    Step5: Request a Public IP Address

    $gwpip= New-AzureRmPublicIpAddress -Name gwpip -ResourceGroupName TestRG1 -Location “Australia East” -AllocationMethod Dynamic

    Step6: Create Gateway IP Address

    $vnet = Get-AzureRmVirtualNetwork -Name TestVNet1 -ResourceGroupName TestRG1

    $subnet = Get-AzureRmVirtualNetworkSubnetConfig -Name “GatewaySubnet” -VirtualNetwork $vnet

    $gwipconfig = New-AzureRmVirtualNetworkGatewayIpConfig -Name gwipconfig1 -SubnetId $subnet.Id -PublicIpAddressId $gwpip.Id

    Step7: Create VPN Gateway

    New-AzureRmVirtualNetworkGateway -Name VNet1GW -ResourceGroupName TestRG1 -Location “Australia East” -IpConfigurations $gwipconfig -GatewayType Vpn -VpnType RouteBased -GatewaySku VpnGw1

    Step8: Extract public IP address of the VPN Gateway

    Get-AzureRmPublicIpAddress -Name GW1PublicIP -ResourceGroupName TestRG1

    Step9: Create VPN Connection

    $gateway1 = Get-AzureRmVirtualNetworkGateway -Name VNet1GW -ResourceGroupName TestRG1

    $local = Get-AzureRmLocalNetworkGateway -Name Site2 -ResourceGroupName TestRG1

    New-AzureRmVirtualNetworkGatewayConnection -Name VNet1toSite2 -ResourceGroupName TestRG1 -Location “East US” -VirtualNetworkGateway1 $gateway1 -LocalNetworkGateway2 $local -ConnectionType IPsec -RoutingWeight 10 -SharedKey “ DkiMgMdcbqvYREEuIvxsbKkW0FOyDiLM”

    Step10: verify Connection

    Get-AzureRmVirtualNetworkGatewayConnection -Name MyGWConnection -ResourceGroupName MyRG