How to Configure Automatic Connectivity to Azure Virtual WAN

VPN connections from a CloudGen Firewall to the Azure Virtual WAN hub are provisioned automatically. The automatic configuration provides a robust and redundant connection by introducing two active-active IPsec IKEv2 VPN tunnels for each ISP with the respective BGP setup and fully automated Azure Virtual WAN site creation on Microsoft Azure. All necessary services on the CloudGen Firewall (BGP and VPN) are created and configured automatically. The finished deployment allows for both branch-to-branch and branch-to-cloud connections. If you disable or delete the configuration on your CloudGen Firewall, make sure to delete the resources in Azure as soon as Virtual WAN is no longer needed.

Open

• For CC admins to be able to trigger the virtual WAN configuration, cloud integration permissions are required. For the CC admin to be able to see the automatically created services, read permissions for VPN and BGP services are required. The automation service itself is not run in the scope of the CC admin that triggered the connection.

• Create an Azure service principal to allow the firewall to authenticate to the Azure Virtual WAN APIs. For more information, see How to Create a Service Principal for Azure Virtual WAN.

• Verify that Barracuda Online Services can be accessed by the appliance. For more information, see Best Practice - Hostname List for Barracuda Networks Online Services.

Before you start with Step 1, configure the following on firewalls hosted in the public cloud:

• The firewall virtual machine must have multiple network interface cards (at least 2). Those network interface cards must be attached to different subnets.

• Each network interface card used for the connection to the Virtual WAN needs its own public IP address.

• Configure Direct Internet Access for each interface used for the connection to the Virtual WAN. See Step 1.

You must have a static IPv4 public IP address. Your links must have similar bandwidth and latency if you want to use more than one ISP. The management interface can not be used as an ISP link port.

1. Configure your ISP. For more information, see How to Configure an ISP with Static IP Addresses, How to Configure an ISP with Dynamic IP Addresses (DHCP), xDSL WAN Connections or WAN Connections.

2. Verify that the setting Direct Internet Access is enabled in your ISP configuration, unless you are using xDSL. 

3. Configure direct attached routes to announce the local networks that should have access to cloud resources. For more information, see the Advertise Route setting in How to Configure Directly Attached Routes .

1. Log into the Azure portal: https://portal.azure.com

2. In the left menu, click Create a resource and search for Virtual WAN.

3. Click Virtual WAN.
    

4. In the next blade, click Create.

5. In the Create WAN blade, specify values for the following:

   • Resource Group – Select an existing resource group from the drop-down menu, or create a new one.

   • Resource group location – Select the region of the Virtual WAN, e.g., West Europe .

   • Name – Enter a name for your Virtual WAN.

   • Type – Select Standard if you want to use multiple ISP for the connection of your firewall to Microsoft Azure Virtual WAN or hub-to-hub/routing mesh for peered VNETs, or if you want to connect the hubs in Azure. Otherwise, select Basic.
     

     Open

     

6. Click Review + Create.

7. Click Create to finish Virtual WAN creation.

1. Log into the Azure portal: https://portal.azure.com

2. In the left menu, click All services  and search for Resource groups.

3. Click on the resource group your vWAN is attached to. See Step 2.

4. Click on your vWAN created in Step 2.

5. On the left side, click Hubs.

6. In the next blade, click + New Hub.
   

   Open

   

7. The Create virtual hub blade opens. Specify values for the following:

   • Region – Select a region from the drop-down list, e.g., West Europe .

   • Name – Enter a name for the hub, e.g., doc-vwan-hub.

   • Hub private address space - Enter the hub's address range in CIDR, e.g., 10.0.0.0/24. Select a unique network that is dedicated for the hub only.
     

      
     

8. Click Next: Site to site >.

9. The Site to site blade opens. Specify the values for the following:
   

   • Do you want to create a Site to site (VPN gateway) - Select Yes.

   • Gateway scale units – Select a scale unit from the drop-down menu according to your requirements.
      

     
     

10. Click Review + create.

11. Review your settings and click Create to start the creation of the hub. This can take up to 30 minutes.

1. Log into the CloudGen Firewall with Firewall Admin.

2. Go to CONFIGURATION > Configuration Tree > Multi Range > your range > your cluster > Boxes > your Box > Advanced Configuration > Cloud Integration.

3. Select Azure Virtual WAN in the left menu.

4. Click Lock.

5. In the Azure Virtual WAN Connections section, click +.

6. Enter a name for your virtual WAN and click OK.

7. The Azure Virtual WAN Connections window opens. Specify values for the following:

   • Virtual WAN Name – Enter the name of the virtual WAN created in Step 2.

   • Resource Group – Enter the name of the resource group containing the virtual WAN.

   • Subscription Id – Enter the ID of the subscription containing the Virtual WAN.

   • Tenant Id – Enter the tenant ID of the Azure account containing the Virtual WAN.

   • Client Id – Enter the ID of the application used to authenticate to the Azure API.

   • Client Password  New – Enter the password for the application used to authenticate to the Azure API.

   • Client Password  Confirm – Retype the password for the application used to authenticate to the Azure API.

   • Virtual Hub Name – Enter the name of the hub created in Step 3.

   • Active – Select Yes.
     

      
     
     

8. Click OK

9. Click Send Changes and Activate.