New-AzVirtualNetworkGatewayConnection

Module:

Az.Network Module

Creates the Site-to-Site VPN connection between the virtual network gateway and the on-prem VPN device.

New-AzVirtualNetworkGatewayConnection
 -Name <String>
 -ResourceGroupName <String>
 -Location <String>
 -VirtualNetworkGateway1 <PSVirtualNetworkGateway>
 -ConnectionType <String>
 [-AuthorizationKey <String>]
 [-VirtualNetworkGateway2 <PSVirtualNetworkGateway>]
 [-LocalNetworkGateway2 <PSLocalNetworkGateway>]
 [-RoutingWeight <Int32>]
 [-DpdTimeoutInSeconds <Int32>]
 [-ConnectionMode <String>]
 [-SharedKey <String>]
 [-Peer <PSPeering>]
 [-EnableBgp <Boolean>]
 [-UseLocalAzureIpAddress]
 [-Tag <Hashtable>]
 [-Force]
 [-UsePolicyBasedTrafficSelectors <Boolean>]
 [-IpsecPolicies <PSIpsecPolicy[]>]
 [-TrafficSelectorPolicy <PSTrafficSelectorPolicy[]>]
 [-ConnectionProtocol <String>]
 [-IngressNatRule <PSResourceId[]>]
 [-EgressNatRule <PSResourceId[]>]
 [-GatewayCustomBgpIpAddress <PSGatewayCustomBgpIpConfiguration[]>]
 [-AuthenticationType <String>]
 [-CertificateAuthentication <PSCertificateAuthentication>]
 [-AsJob]
 [-ExpressRouteGatewayBypass]
 [-EnablePrivateLinkFastPath]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

New-AzVirtualNetworkGatewayConnection
 -Name <String>
 -ResourceGroupName <String>
 -Location <String>
 -VirtualNetworkGateway1 <PSVirtualNetworkGateway>
 -ConnectionType <String>
 [-AuthorizationKey <String>]
 [-VirtualNetworkGateway2 <PSVirtualNetworkGateway>]
 [-LocalNetworkGateway2 <PSLocalNetworkGateway>]
 [-RoutingWeight <Int32>]
 [-DpdTimeoutInSeconds <Int32>]
 [-ConnectionMode <String>]
 [-SharedKey <String>]
 [-PeerId <String>]
 [-EnableBgp <Boolean>]
 [-UseLocalAzureIpAddress]
 [-Tag <Hashtable>]
 [-Force]
 [-UsePolicyBasedTrafficSelectors <Boolean>]
 [-IpsecPolicies <PSIpsecPolicy[]>]
 [-TrafficSelectorPolicy <PSTrafficSelectorPolicy[]>]
 [-ConnectionProtocol <String>]
 [-IngressNatRule <PSResourceId[]>]
 [-EgressNatRule <PSResourceId[]>]
 [-GatewayCustomBgpIpAddress <PSGatewayCustomBgpIpConfiguration[]>]
 [-AuthenticationType <String>]
 [-CertificateAuthentication <PSCertificateAuthentication>]
 [-AsJob]
 [-ExpressRouteGatewayBypass]
 [-EnablePrivateLinkFastPath]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Creates the Site-to-Site VPN connection between the virtual network gateway and the on-prem VPN device.

$vnetgw1 = Get-AzVirtualNetworkGateway -ResourceGroupName "Rg1" -Name "gw1"
$vnetgw2 = Get-AzVirtualNetworkGateway -ResourceGroupName "Rg1" -Name "gw2"
New-AzVirtualNetworkGatewayConnection -Name conn-client-1 -ResourceGroupName "Rg1" -VirtualNetworkGateway1 $vnetgw1 -VirtualNetworkGateway2 $vnetgw2 -Location "eastus" -ConnectionType Vnet2Vnet -SharedKey 'a1b2c3d4e5'

$vnetgw1 = Get-AzVirtualNetworkGateway -ResourceGroupName "Rg1" -Name "vnetgw1"
$vnetgw2 = Get-AzVirtualNetworkGateway -ResourceGroupName "Rg1" -Name "vnetgw2"
$ingressnatrule = Get-AzVirtualNetworkGatewayNatRule -ResourceGroupName "Rg1" -Name "natRule1" -ParentResourceName vnetgw1
$egressnatrule = Get-AzVirtualNetworkGatewayNatRule -ResourceGroupName "Rg1" -Name "natRule2" -ParentResourceName vnetgw1
New-AzVirtualNetworkGatewayConnection -Name conn-client-1 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnetgw1 -VirtualNetworkGateway2 $vnetgw2 -Location "eastus" -ConnectionType Vnet2Vnet -SharedKey 'a1b2c3d4e5' `
-IngressNatRule $ingressnatrule -EgressNatRule $egressnatrule

The first command gets a virtual network gateway natRule named natRule1 that's type is IngressSnat. The second command gets a virtual network gateway natRule named natRule2 that's type is EgressSnat. The third command creates this new virtual Network gateway connection with Ingress and Egress NatRules.

$LocalnetGateway = Get-AzLocalNetworkGateway -ResourceGroupName "PS_testing" -name "testLng"
$gateway = Get-AzVirtualNetworkGateway -ResourceGroupName PS_testing -ResourceName testGw
$address = New-AzGatewayCustomBgpIpConfigurationObject -IpConfigurationId "/subscriptions/83704d68-d560-4c67-b1c7-12404db89dc3/resourceGroups/PS_testing/providers/Microsoft.Network/virtualNetworkGateways/testGw/ipConfigurations/default" -CustomBgpIpAddress "169.254.21.1"

New-AzVirtualNetworkGatewayConnection -ResourceGroupName "PS_testing" -name "Conn" -location "eastus" -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $localnetGateway -ConnectionType IPsec -RoutingWeight 3 -SharedKey abc -GatewayCustomBgpIpAddress $address -EnableBgp $true

The two command gets a local network gateway and virtual network gateway. The third command creates a AzGatewayCustomBgpIpConfigurationObject. The third command creates this new virtual Network gateway connection with GatewayCustomBgpIpAddress.

$gateway = Get-AzVirtualNetworkGateway -ResourceGroupName "myResourceGroup" -Name "myVnetGateway"
$localGateway = Get-AzLocalNetworkGateway -ResourceGroupName "myResourceGroup" -Name "myLocalGateway"

# Create certificate chain array with base64-encoded certificates (without BEGIN/END CERTIFICATE headers)
$certChain = @(
 "MIIDfzCCAmegAwIBAgIQIFxjNWTuGjYGa8zJVnpfnDANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1DZXJ0QmFzZWRBdXRoMB4XDTI0MTIxODA1MjkzOVoXDTI1MTIxODA2MDk...",
 "MIIDezCCAmOgAwIBAgIQQIpJdJF8D8JwkqF6fJ6zGDANBgkqhkiG9w0BAQsFADAYMRYwFAYDVQQDDA1DZXJ0QmFzZWRBdXRoMB4XDTI0MTIxODA1MjkzOVoXDTI1MTIxODA2MDk..."
)

$certAuth = New-AzVirtualNetworkGatewayCertificateAuthentication `
 -OutboundAuthCertificate "https://myvault.vault.azure.net/certificates/mycert/abc123" `
 -InboundAuthCertificateSubjectName "MyCertSubject" `
 -InboundAuthCertificateChain $certChain

New-AzVirtualNetworkGatewayConnection -Name "myCertConnection" -ResourceGroupName "myResourceGroup" -Location "eastus" `
 -VirtualNetworkGateway1 $gateway -LocalNetworkGateway2 $localGateway -ConnectionType IPsec `
 -AuthenticationType "Certificate" -CertificateAuthentication $certAuth

This example creates a new virtual network gateway connection with certificate-based authentication. The first two commands get the virtual network gateway and local network gateway. The New-AzVirtualNetworkGatewayCertificateAuthentication cmdlet creates the certificate authentication configuration with the Key Vault certificate URL for outbound authentication, the certificate subject name for inbound authentication, and the certificate chain. The final command creates the new connection with certificate-based authentication instead of a pre-shared key.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.