RV34x: how to set up a VPN to Microsoft Azure

[oatroshc]

Symptoms

Cisco RV34s comes with pre-defined Microsoft Azure IPSec profile, but seems it's impossible to set up a tunnel with Azure just using default settings.

Diagnosis

First, you can find messages in RV34x logs like follow:

charon: 11[NET] received unsupported IKE version 2.0 from (peer_IP), sending INVALID_MAJOR_VERSION

info

vpn

charon: 11[NET] sending packet: from (site_IP)[500] to (peer_IP)[500] (40 bytes)

info

vpn

charon: 11[ENC] generating INFORMATIONAL_V1 request 0 [ N(INVAL_MAJOR) ]

The issue is happening due to RV34x seems does not understand IKEv2. Currently Azure supports both modes of VPN gateways: route-based VPN (default) and policy-based. Here is a difference between (taken from

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

https://docs.microsoft.com/sv-se/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsku ):

Azure	PolicyBased VPN Gateway	RouteBased VPN Gateway
Azure Gateway SKU	Basic	Basic, Standard, HighPerformance, VpnGw1, VpnGw2, VpnGw3
IKE version	IKEv1	IKEv2
Max. S2S connections	1	Basic/Standard: 10 HighPerformance: 30

So, it seems that a workaround could be to change the VPN mode on Azure side to the policy-based one, which could supply IPSec profile with IKEv1.

Solution

1. On RV34x set up IPSec Profilre for Azure as follow:

Phase 1:

DH = group 2

Encryption = AES-256

Intergrity = SHA1

PFS = no

Lifetime = 28800

Phase 2:

Encryption = AES-256

Integrity = SHA-256

LIfetime = 3600

2. On RV34x set up IPSec Advanced Settings for profile:

Keep-alive = Enabled

Aggressive Mode = Disabled

3. On Azure site:

Set up Virtual Connection to "policy-based VPN gateway" instead of "route-based" one.

Enjoy, but remember about Azure's restriction to allow 1 S2S connection only for policy-based VPN gateway IPSec.

[ahmadsaleh]

Thank you for sharing it. We have setup site to site between Cisco RV345P and Azure network and we have the connection up and we can see Data In/out. but when we try to RDP  to azure VM added to same VNet  from on-premise network its not working. we have tried to ping the azure vm using private ip but is not working. Any Idea? 

are there other settings we have to enable in Cisco Router to make the resources between the two private networks visible? another thing we were able to ping the router private ip from azure VM.

Thanks 

[oatroshc]

Hello ahmadsaleh,

Unfortunately, your message does not bring up helpful details, like topology or logs.

I would suggest to analyze logs on both ends first, better around the issue time.

Oleksiy.

[ahmadsaleh]

Thank you for the reply. Below are my settings:

On premise:

1) VLAN: 192.168.0.20 255.255.255.0.

2) IPSec/IKE profile is the same as you posted.

3) Created site to site vpn :
for local group match with on premise. used the public ip for router and VLAN Ip address
for remote group match with azure. Used the public id for the gateway and address space for azure network

Azure Setting :

1) Created Azure Virtual Network with address space: 10.1.0.0/16

2) Created 2 subnets Azure Virtual Network :
Default: 10.1.0.0/24
GatewaySubnet: 10.1.1.0/24

3) Created Gateway with Policy Based vpn type and basic SKU.

4) Created local network gateway with public id for on premise router and subnet for on premise VLAN network.

5) Created connection of type Site-to-Site(IPsec) using IKEv1 in virtual Gateway. Shared key is the same on both.

6) Created azure VM in azure in the same Azure Virtual Network.

at this point, Do I need to create more settings on azure Like Route Table?

***The connection status on both on premise and azure UP but I have the following issues:

a) When I ping from azure VM, on premise router IP 192.168.0.20 its working.
b) When I ping from azure VM, any on premise resources like file server, is not working.
c) When I RDP the azure vm private IP from on premise network is not working.

Also, could you please help me where I do find the log for the cisco router?

Thanks,
Ahmad

[oatroshc]

Hello Ahmad,

First, it's a good thing that the tunnel comes up. This means that negotiation policies are okay and the connection has been established successfully.

Another thing, how data is being exchanged. As a base, the proper routing should be set up on both ends, explicitly understand what means 'working' and 'not working' from the tech purpose, use ping not only indicating destination but also paying attention which source is used. Please take into account if any firewall is installed between two ends - this could also affect the traffic behavior.

I would also suggest to use traceroute/tracert/mtr family utulities to collect as much as possible debug info.

I hope this helps.

Oleksiy.

[SeanHodgkinson68170]

Oleksiy,

Does the router still not understand IKEv2 for Azure connections even with the latest firmware 

[Martin Aleksandrov]

@SeanHodgkinson68170 

Starting from 1.0.2.16 the RV34x do support IKEv2.

https://www.cisco.com/c/en/us/support/docs/smb/routers/cisco-rv-series-small-business-routers/Configuring_IKEv2_on_the_RV34x_Series_Router.html

Regards,

Martin

[SeanHodgkinson68170]

I need some help .. Im trying to configure the RV340 to connect site to site to the Azure portal.. I'm sure everything is correct . I have concerns about the IPspec and authentication  . can someone guide me please..