Watguard Connect to Azure VPN Site to Site: A Step-by-Step Guide

To connect Watguard to an Azure VPN site-to-site, you'll need to create a virtual network gateway in the Azure portal. This gateway will serve as the entry point for the VPN connection.

First, ensure you have an Azure subscription and a Watguard device configured for VPN connectivity. The Watguard device must be running firmware version 5.1 or later.

Next, navigate to the Azure portal and create a new virtual network gateway. Choose the "VPN" option and select the "Site-to-Site" connection type.

Recommended read: Azure Vpn Gateway Skus

To set up WatchGuard, start by using the WatchGuard Policy Manager, a graphical client utility that's a favorite among long-time admins.

From Policy Manager, navigate to VPN > BOVPNVirtualInterfaces.

Most admins prefer this method over the web interface, and it's a great place to start.

You'll need to edit the fields in BOVPNVirtualInterfaces, specifically checking the WatchGuard System Manager.

To start, you need to add a BOVPN interface. Navigate to VPN>BOVPNVirtualInterfaces and click Add.

Additional reading: Git Remote Add Azure

Specify the Interface Name, which can be any name you like, but mine is BovpnVif.Azure. Choose the Remote Endpoint Type from the drop-down, either Cloud VPN or Third-Party Gateway.

You'll need to use a Pre-Shared Key, which you specified in the Azure portal on the Connection object. To find it again, go to All resources > click your Connection > Shared key under Settings.

Under the first area, specify the local address, which is the public IP assigned to your firewall. You'll also need to pick the physical interface that corresponds to this external IP address.

For the Remote Gateway, specify the Azure public IP address that was provisioned during the previous setup – twice, in both fields.

The network route is what tells your firewall about the address space hiding behind the cloudy gateway in Azure. To add a network route, click on VPN Routes, then Add.

Here are the steps to add a network route:

Now, go to the Phase 1 Settings tab and choose IKEv2 from the drop-down under Version. Click Save at the bottom of the screen to complete the setup.

To verify connectivity, go to the Azure portal and click on your Connection object in the All resources section. This will give you a clear view of your connection status.

An even better test is to deploy a VM into the new network and verify that you can communicate back to your on-premises network. This will ensure a smooth and reliable connection.

Verify that your connection is established by checking the Azure portal.

Discover more: Azure Connection String

Network Configuration is a crucial step in setting up a Watguard connection to Azure VPN site-to-site. You'll need to configure the network route to establish a secure and reliable connection.

To start, go back to the New BOVPN Virtual Interface screen and click on the VPN Routes tab. From there, click the Add button to create a new route. Here, you'll need to specify the network address space behind the gateway in Azure.

Choose Network IPv4 from the dropdown menu, then enter the IP address space of the Azure virtual network, which was set up previously. Click OK to save your changes.

Consider reading: Azure Space

To establish a secure connection between two sites, you'll need to configure IPsec on-prem. This involves setting up a VPN (Virtual Private Network) to encrypt traffic between the sites.

The first step is to create a Phase 1 (IKE) policy, which defines the encryption and authentication settings for the VPN. This policy includes settings such as the encryption algorithm, authentication method, and Diffie-Hellman group.

A common encryption algorithm used in IPsec is AES (Advanced Encryption Standard) with a key size of 256 bits. This provides strong encryption and protection for sensitive data.

The authentication method can be set to either pre-shared key (PSK) or digital certificate (X.509). PSK is a simple and widely used method, but it has its limitations.

A Phase 2 (IPsec) policy is also required, which defines the security association (SA) settings for the VPN. This includes settings such as the protocol, encryption algorithm, and authentication method.

When configuring IPsec on-prem, it's essential to ensure that the Phase 1 and Phase 2 policies are properly synchronized between the sites. This can be achieved by using a centralized management system or manual configuration.

Intriguing read: What Is Azure Used for

To configure the network route, head back to the New BOVPN Virtual Interface screen and navigate to the VPN Routes tab. Click Add to proceed.

You'll need to specify the network address space behind the gateway in Azure. Choose Network IPv4 from the dropdown menu.

Enter the IP address space of the Azure virtual network, which was setup previously. This is crucial for establishing a connection.

Click OK to save your changes and move forward with the configuration.

On a similar theme: Azure Site Recovery Provides for Virtual Machines

To establish a secure connection between your on-premises network and Azure, you'll need to set up an Azure VPN Connection.

Verify connectivity by going to the Azure portal, clicking on All resources, and then selecting your Connection object.

An even better test is to deploy a VM into the new network and verify that you can communicate back to your on-premises network.

You might like: Wix Website - Site Page to Different Webpage on Site