[NEBULA] How to estatblish Site to Site IPSec VPN between NSG and Microsoft Azure?

Zyxel_Jason Posts: 395  Master Member
First Anniversary 10 Comments Friend Collector First Answer
Here is the example for the user who uses Zyxel NSG and Microsoft Azure and wants to configure Site-to-Site VPN configuration.
It only has a few simple steps to accomplish securitly VPN connection between two Cloud Management Platforms!


Let's begin with the steps on NSG and Microsoft Azure!

[For NSG] (Please note that NSG needs to have public IP, not behind NAT scenario.)
1. Go to Configure > Security gateway > Site-to-Site VPN.
2. Select "Outgoing Interface" and "Local networks".

3. Click "Add" in Non-Nebula VPN peers section and configure "Name", "Public IP", "Private subnet" and "Preshared secret" that matchs to peer device.

( is a pingable virtual machine in Azure network)

4. In IPsec policy, configure Preset as "Azure policy-based", the parameter of Phase 1 and 2 will be loaded by default settings of Microsoft Azure.

5. Click "OK" and "Save" to apply when everything is done.

[For Microsoft Azure]
1. Create Azure virtual network.
"Create a resource > Networking > Virtual network"
Configure required information.

2. Configure virtual network gateway.
"Create a resource > Networking > Virtual network gateway"

Gateway type = VPN
VPN type = Policy-based
Virtual network = Choose the virtual network you created.
Gateway subnet address range =  It is OK to use system default.
Public IP address = Create new with a customize name.

3. Configure Local network gateway.
"Create a resource > Networking > Local network gateway"

IP address = Your NSG Public IP
Address space =  The interface address you want to use VPN on NSG

4. Configure Site to Site VPN connection.
"All resources > Virtual network gateway(VPN-GW) > Connections > Add"

Connection type = Site-to-site(IPsec)
Local network gateway = Choose the local network gateway you created.
Shared key (PSK) = Configure key (Remember to be consistent with the configuration on NSG)

From perspective of NSG, access to "Monitor > Security gateway > VPN connections" to check VPN status.

Ping test from PC(, which is under NSG's LAN.

From perspective of Microsoft Azure,  click "All resources > Connection(NSG_Azure_VPN)" to check VPN status.

Ping test from VM host(Win10 PC), which is on Azure network.