Connect a site with quick setup
Create a site connection and every object it needs from one name with recommended settings, and supply only the remote network, peer address, and key.
Quick setup creates a site connection, and the VPN service, policies, and endpoint groups that it needs, from one name and with recommended settings. You supply only the remote side: the remote network, the address of the remote VPN device, and a pre-shared key.
Before you begin
- You need the Owner or Contributor role, or a custom role with Manage access to Networking, on the subscription or on the project. Any role with Read access to Networking can view VPN objects.
- The project's region must offer Site-to-Site VPN. See How it works.
- The project needs a router with an external gateway, and the subnets that should reach the remote network must be attached to it. See Attach a subnet.
- Have the remote side ready: the CIDRs of the remote network, the public address of the remote VPN device, and a pre-shared key of at least 8 characters that you also enter on the device.
- The remote device must support the recommended settings in the table below, or you change them in the wizard before you create.
- Use one site connection per peer gateway. If the project already has a connection to this peer, don't create a second one; see Endpoint groups.
Start quick setup
In the console, go to NetworkingVPN.
Select Guided setup. The wizard opens on the VPN service step.
Under Connect with recommended settings, enter a Connection name, for example Ankara DC.
Select Continue with recommended settings.
If the name field is unavailable, the wizard shows Needs a router with an external gateway and at least one subnet in this project.
The name becomes the base of every object name: it's turned into lowercase letters and digits, every other run of characters becomes a hyphen, and a run at the start or the end is dropped. Quick setup fills in every step of the wizard with new objects:
| Object | Name, for Ankara DC | Settings |
|---|---|---|
| VPN service | ankara-dc-vpn | The first router in the step's router list. |
| IKE policy | ankara-dc-ike | IKE v2, main mode, aes-256, sha256, group14, lifetime 3600 seconds. |
| IPsec policy | ankara-dc-ipsec | esp, tunnel mode, aes-256, sha256, group14, lifetime 3600 seconds. |
| Local endpoint group | ankara-dc-local | The first subnet in the step's subnet list. |
| Peer endpoint group | ankara-dc-peer | Empty: you enter the remote CIDRs. |
| Site connection | ankara-dc | You enter the peer gateway address and the pre-shared key. |
The wizard then moves to the Peer endpoint step and shows Recommended settings applied: IKE v2 · aes-256 · sha256 · PFS group14 · 3600s lifetime. For what each setting means, see IKE policies and IPsec policies.
Check the router and the subnets
Important
Quick setup takes the first router and the first subnet in the lists, without checking that the subnet is attached to the router. If it isn't, the platform refuses the site connection at the very end, after the other five objects were created. Check both before you continue.
Select Back until you reach the VPN service step, and check the Router.
Select Next until you reach the Local endpoint step. Under Local subnets, select every subnet that should reach the remote network, and clear the others. Each one must be attached to the router you checked.
Select Next to return to the Peer endpoint step.
On these steps you can also switch to Use existing to reuse a VPN service, a policy, or an endpoint group that the project already has. For each step, see Create a site connection with the wizard.
Enter the remote side
On the Peer endpoint step, enter the CIDRs of the remote network in Remote CIDRs, for example 172.16.0.0/16. Separate several CIDRs with commas.
In Peer gateway address, enter the public address of the remote VPN device, and select Next.
On the Site connection step, enter the Pre-shared key: at least 8 characters, the same as on the remote device.
Check Initiator, the dead peer detection settings, and MTU. The MTU starts at the smallest MTU of the project's networks. For each field, see Site connections.
Select Next.
For what the wizard and the platform check on this step, see Site connection.
Review and create
On the Summary step, check the names. Every object shows Will be created, or Reused for an object you chose to reuse.
Select Create VPN connection.
Result
The wizard creates the VPN service, the two policies, and the two endpoint groups one after another, waiting up to a time limit for each one to finish, and then the site connection. If an object still isn't ready when the wizard creates the site connection, the platform refuses the connection, and the run stops. When the site connection is created, its page opens and shows the tunnel status that the provider reported.
The tunnel comes up when the remote device is configured with matching settings. The address that the device connects to is the VPN service's external address: on the connection's page, it's next to the VPN service under References. For every setting the device needs, see Configure the peer device.
If the run stops before the site connection is created, the wizard lists the objects it already created and lets you keep them or delete them. See If the run stops part-way.
Troubleshooting
| Message | Cause | Resolution |
|---|---|---|
| Needs a router with an external gateway and at least one subnet in this project. | The project has no router with an external gateway, or no subnet. | Create them, and open Guided setup again. |
If the platform refuses an object, see Creating an object is refused. To keep or delete what the run already created, see If the run stops part-way. For more problems, see Troubleshoot site connections.