azurerm_virtual_network_gateway_connection

Manages a connection in an existing Virtual Network Gateway.

Example Usage

Site-to-Site connection

The following example shows a connection between an Azure virtual network and an on-premises VPN device and network.

resource "azurerm_resource_group" "example" {
  name     = "test"
  location = "West US"
}

resource "azurerm_virtual_network" "example" {
  name                = "test"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "example" {
  name                 = "GatewaySubnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_local_network_gateway" "onpremise" {
  name                = "onpremise"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  gateway_address     = "168.62.225.23"
  address_space       = ["10.1.1.0/24"]
}

resource "azurerm_public_ip" "example" {
  name                = "test"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  allocation_method   = "Dynamic"
}

resource "azurerm_virtual_network_gateway" "example" {
  name                = "test"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  type     = "Vpn"
  vpn_type = "RouteBased"

  active_active = false
  enable_bgp    = false
  sku           = "Basic"

  ip_configuration {
    public_ip_address_id          = azurerm_public_ip.example.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.example.id
  }
}

resource "azurerm_virtual_network_gateway_connection" "onpremise" {
  name                = "onpremise"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name

  type                       = "IPsec"
  virtual_network_gateway_id = azurerm_virtual_network_gateway.example.id
  local_network_gateway_id   = azurerm_local_network_gateway.onpremise.id

  shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
}

VNet-to-VNet connection

The following example shows a connection between two Azure virtual network in different locations/regions.

resource "azurerm_resource_group" "us" {
  name     = "us"
  location = "East US"
}

resource "azurerm_virtual_network" "us" {
  name                = "us"
  location            = azurerm_resource_group.us.location
  resource_group_name = azurerm_resource_group.us.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "us_gateway" {
  name                 = "GatewaySubnet"
  resource_group_name  = azurerm_resource_group.us.name
  virtual_network_name = azurerm_virtual_network.us.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_public_ip" "us" {
  name                = "us"
  location            = azurerm_resource_group.us.location
  resource_group_name = azurerm_resource_group.us.name
  allocation_method   = "Dynamic"
}

resource "azurerm_virtual_network_gateway" "us" {
  name                = "us-gateway"
  location            = azurerm_resource_group.us.location
  resource_group_name = azurerm_resource_group.us.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "Basic"

  ip_configuration {
    public_ip_address_id          = azurerm_public_ip.us.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.us_gateway.id
  }
}

resource "azurerm_resource_group" "europe" {
  name     = "europe"
  location = "West Europe"
}

resource "azurerm_virtual_network" "europe" {
  name                = "europe"
  location            = azurerm_resource_group.europe.location
  resource_group_name = azurerm_resource_group.europe.name
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "europe_gateway" {
  name                 = "GatewaySubnet"
  resource_group_name  = azurerm_resource_group.europe.name
  virtual_network_name = azurerm_virtual_network.europe.name
  address_prefixes     = ["10.1.1.0/24"]
}

resource "azurerm_public_ip" "europe" {
  name                = "europe"
  location            = azurerm_resource_group.europe.location
  resource_group_name = azurerm_resource_group.europe.name
  allocation_method   = "Dynamic"
}

resource "azurerm_virtual_network_gateway" "europe" {
  name                = "europe-gateway"
  location            = azurerm_resource_group.europe.location
  resource_group_name = azurerm_resource_group.europe.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "Basic"

  ip_configuration {
    public_ip_address_id          = azurerm_public_ip.europe.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.europe_gateway.id
  }
}

resource "azurerm_virtual_network_gateway_connection" "us_to_europe" {
  name                = "us-to-europe"
  location            = azurerm_resource_group.us.location
  resource_group_name = azurerm_resource_group.us.name

  type                            = "Vnet2Vnet"
  virtual_network_gateway_id      = azurerm_virtual_network_gateway.us.id
  peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.europe.id

  shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
}

resource "azurerm_virtual_network_gateway_connection" "europe_to_us" {
  name                = "europe-to-us"
  location            = azurerm_resource_group.europe.location
  resource_group_name = azurerm_resource_group.europe.name

  type                            = "Vnet2Vnet"
  virtual_network_gateway_id      = azurerm_virtual_network_gateway.europe.id
  peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.us.id

  shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
}

Argument Reference

The following arguments are supported:


The custom_bgp_addresses block supports:


The ipsec_policy block supports:


The traffic_selector_policy block supports:

Attributes Reference

In addition to the Arguments listed above - the following Attributes are exported:

Timeouts

The timeouts block allows you to specify timeouts for certain actions:

Import

Virtual Network Gateway Connections can be imported using their resource id, e.g.

terraform import azurerm_virtual_network_gateway_connection.exampleConnection /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myGroup1/providers/Microsoft.Network/connections/myConnection1