Configure a VNet-to-VNet VPN gateway connection using the Azure portal

This article helps you connect virtual networks by using the VNet-to-VNet connection type. The virtual networks can be in the same or different regions, and from the same or different subscriptions. When connecting VNets from different subscriptions, the subscriptions do not need to be associated with the same Active Directory tenant.

About connecting VNets

VNet-to-VNet

Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when communicating. The difference between the connection types is the way the local network gateway is configured. When you create a VNet-to-VNet connection, you do not see the local network gateway address space. It is automatically created and populated. If you update the address space for one VNet, the other VNet automatically knows to route to the updated address space. Creating a VNet-to-VNet connection is typically faster and easier than creating a Site-to-Site connection between VNets.

Site-to-Site (IPsec)

If you are working with a complicated network configuration, you may prefer to connect your VNets using the Site-to-Site steps instead. When you use the Site-to-Site IPsec steps, you create and configure the local network gateways manually. The local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional address space for the local network gateway in order to route traffic. If the address space for a VNet changes, you need to update the corresponding local network gateway to reflect that. It does not automatically update.

VNet peering

You may want to consider connecting your VNets using VNet Peering. VNet peering does not use a VPN gateway and has different constraints. Additionally, VNet peering pricing is calculated differently than VNet-to-VNet VPN Gateway pricing. For more information, see VNet peering.

Why create a VNet-to-VNet connection?

VNet-to-VNet communication can be combined with multi-site configurations. This lets you establish network topologies that combine cross-premises connectivity with inter-virtual network connectivity,

The process involves the following steps:

1. Create a VNet
2. Add a gateway subnet
3. Assign a public IP address
4. Add a virtual network gateway
5. Repeat steps 1 – 4 to create a second VNet
6. Create a connection object that connects the two virtual network gateways

Create a new virtual network

1. From a browser, navigate to the Azure portal and, if necessary, sign in with your Azure account.
2. Click +. In the Search the marketplace field, type "Virtual Network". Locate Virtual Network from the returned list and click to open the Virtual Network page.

3.Near the bottom of the Virtual Network page, from the Select a deployment model list,       select Resource Manager, and then click Create.

On the Create virtual network page, configure the VNet settings. When you fill in the fields, the red exclamation mark becomes a green check mark when the characters entered in the field are valid. There may be values that are auto-filled. If so, replace the values with your own. The Create virtual network page looks similar to the following example:

1. Name: Enter the name for your virtual network.
2. Address space: Enter the address space. If you have multiple address spaces to add, add your first address space. You can add additional address spaces later, after creating the VNet.
3. Subscription: Verify that the Subscription listed is the correct one. You can change subscriptions by using the drop-down.
4. Resource group: Select an existing resource group, or create a new one by typing a name for your new resource group. If you are creating a new group, name the resource group according to your planned configuration values. For more information about resource groups, visit Azure Resource Manager Overview.
5. Location: Select the location for your VNet. The location determines where the resources that you deploy to this VNet will reside.
6. Subnet: Add the subnet name and subnet address range. You can add additional subnets later, after creating the VNet.

2. Add additional address space and create subnets

    You can add additional address space and create subnets once your VNet has been                created.

To add additional address space

1. To add additional address space, under the Settings section on your virtual network page, click Address space to open the Address space page.
2. Add the additional address space, and then click Save at the top of the page.

To create additional subnets

1. To create subnets, in the Settings section of your virtual network page, click Subnets to open the Subnets page.
2. On the Subnets page, click +Subnet to open the Add subnet page. Name your new subnet and specify the address range.

To save your changes, click OK at the bottom of the page.

3. Create a gateway subnet

Before creating a virtual network gateway for your virtual network, you first need to create the gateway subnet. The gateway subnet contains the IP addresses that are used by the virtual network gateway. If possible, it's best to create a gateway subnet using a CIDR block of /28 or /27 in order to provide enough IP addresses to accommodate additional future configuration requirements.

To create a gateway subnet

1. In the portal, navigate to the Resource Manager virtual network for which you want to create a virtual network gateway.
2. In the Settings section of your VNet page, click Subnets to expand the Subnets page.
3. On the Subnets page, click +Gateway subnet to open the Add subnet page.

4.The Name for your subnet is automatically filled in with the value 'GatewaySubnet'. This value is required in order for Azure to recognize the subnet as the gateway subnet. Adjust the auto-filled Address range values to match your configuration requirements, then click OK at the bottom of the page to create the subnet.

4. Specify a DNS server (optional)

DNS is not required for VNet-to-VNet connections. However, if you want to have name resolution for resources that are deployed to your virtual network, you should specify a DNS server. This setting lets you specify the DNS server that you want to use for name resolution for this virtual network. It does not create a DNS server.

1. On the Settings page for your virtual network, navigate to DNS Servers and click to open the DNS servers page.

1. • DNS Servers: Select Custom.
   • Add DNS server: Enter the IP address of the DNS server that you want to use for name resolution.
2. When you are done adding DNS servers, click Save at the top of the page.

5. Create a virtual network gateway

In this step, you create the virtual network gateway for your VNet. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU

To create a virtual network gateway

1. In the portal, on the left side, click + and type 'virtual network gateway' in search. Locate Virtual network gateway in the search return and click the entry. On the Virtual network gateway page, click Create at the bottom of the page to open the Create virtual network gatewaypage.
2. On the Create virtual network gateway page, fill in the values for your virtual network gateway.

On the Create virtual network gateway page, specify the values for your virtual network gateway.

• Name: Name your gateway. This is not the same as naming a gateway subnet. It's the name of the gateway object you are creating.
• Gateway type: Select VPN. VPN gateways use the virtual network gateway type VPN.
• VPN type: Select the VPN type that is specified for your configuration. Most configurations require a Route-based VPN type.
• SKU: Select the gateway SKU from the dropdown. The SKUs listed in the dropdown depend on the VPN type you select. For more information about gateway SKUs, see Gateway SKUs.
• Location: You may need to scroll to see Location. Adjust the Location field to point to the location where your virtual network is located. If the location is not pointing to the region where your virtual network resides, when you select a virtual network in the next step, it will not appear in the drop-down list.
• Virtual network: Choose the virtual network to which you want to add this gateway. Click Virtual network to open the 'Choose a virtual network' page. Select the VNet. If you don't see your VNet, make sure the Location field is pointing to the region in which your virtual network is located.
• Gateway subnet address range: You will only see this setting if you did not previously create a gateway subnet for your virtual network. If you previously created a valid gateway subnet, this setting will not appear.
• First IP configuration: The 'Choose public IP address' page creates a public IP address object that gets associated to the VPN gateway. The public IP address is dynamically assigned to this object when the VPN gateway is created. VPN Gateway currently only supports Dynamic Public IP address allocation. However, this does not mean that the IP address changes after it has been assigned to your VPN gateway. The only time the Public IP address changes is when the gateway is deleted and re-created. It doesn't change across resizing, resetting, or other internal maintenance/upgrades of your VPN gateway.
• First, click Create gateway IP configuration to open the 'Choose public IP address' page, then click +Create new to open the 'Create public IP address' page.
• Next, input a Name for your public IP address. Leave the SKU as Basic unless there is a specific reason to change it to something else, then click OK at the bottom of this page to save your changes.

1. Verify the settings. You can select Pin to dashboard at the bottom of the page if you want your gateway to appear on the dashboard.
2. Click Create to begin creating the VPN gateway. The settings are validated and you'll see the "Deploying Virtual network gateway" tile on the dashboard. Creating a gateway can take up to 45 minutes. You may need to refresh your portal page to see the completed status.

After the gateway is created, view the IP address that has been assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device. You can click the connected device (your virtual network gateway) to view more information.

6.Create and configure TestVNet4

Once you've configured TestVNet1, create TestVNet4 by repeating the previous steps, replacing the values with those of TestVNet4. You don't need to wait until the virtual network gateway for TestVNet1 has finished creating before configuring TestVNet4. If you are using your own values, make sure that the address spaces don't overlap with any of the VNets that you want to connect to.

7. Configure the TestVNet1 gateway connection

When the virtual network gateways for both TestVNet1 and TestVNet4 have completed, you can create your virtual network gateway connections. In this section, you create a connection from VNet1 to VNet4. These steps work only for VNets in the same subscription. If your VNets are in different subscriptions, you must use PowerShell to make the connection. See the PowerShell article. However, if your VNets are in different resource groups in the same subscription, you can connect them using the portal.

1. In All resources, navigate to the virtual network gateway for your VNet. For example, TestVNet1GW. Click TestVNet1GW to open the virtual network gateway page.
   
2. Click +Add to open the Add connection page.
   
3. On the Add connection page, in the name field, type a name for your connection. For example, TestVNet1toTestVNet4.
4. For Connection type, select VNet-to-VNet from the dropdown.
5. The First virtual network gateway field value is automatically filled in because you are creating this connection from the specified virtual network gateway.
6. The Second virtual network gateway field is the virtual network gateway of the VNet that you want to create a connection to. Click Choose another virtual network gateway to open the Choose virtual network gateway page.
7. View the virtual network gateways that are listed on this page. Notice that only virtual network gateways that are in your subscription are listed. If you want to connect to a virtual network gateway that is not in your subscription, please use the PowerShell article.
8. Click the virtual network gateway that you want to connect to.
9. In the Shared key field, type a shared key for your connection. You can generate or create this key yourself. In a site-to-site connection, the key you use would be exactly the same for your on-premises device and your virtual network gateway connection. The concept is similar here, except that rather than connecting to a VPN device, you are connecting to another virtual network gateway.
10. Click OK at the bottom of the page to save your changes.

8. Configure the TestVNet4 gateway connection

Next, create a connection from TestVNet4 to TestVNet1. In the portal, locate the virtual network gateway associated with TestVNet4. Follow the steps from the previous section, replacing the values to create a connection from TestVNet4 to TestVNet1. Make sure that you use the same shared key.

9. Verify your connections

Locate the virtual network gateway in the portal. On the virtual network gateway page, click Connections to view the connections page for the virtual network gateway. Once the connection is established, you see the Status values change to Succeeded and Connected. You can double-click a connection to open the Essentials page and view more information.

When data begins flowing, you see values for Data in and Data out.

Software RAID 1 in Windows 7 for Increased Data Security

 Software RAID 1

Software RAID 1, or "Mirroring", makes an exact copy of all the data between two disks. So, when one of the drives fails - because HDD failure is a matter of time - all data is safe on the other disk. Let's create a software RAID 1 in Windows 7.

To create software RAID 1 with Windows 7, we will need two hard disk drives - preferably of the same size - and at least Windows 7 Professional or Windows 7 Ultimate.

Contents [hide]

• 1 We can't create a software RAID 1 in Windows 7 Home Premium
• 2 Why software RAID 1 and not software RAID 5?
• 3 How to create a software RAID 1 in Windows 7
  • 3.1 Creating a software RAID 1 with brand new disks
  • 3.2 Creating a Software RAID 1 copy of an existing data disk or partition
  • 3.3 Creating a Software RAID 1 for the Windows installation
• 4 What happens when one disk fails in RAID 1
  • 4.1 How to fix a collapsed software RAID 1
• 5 Why choose the Software RAID 1 instead of the motherboards "hardware" RAID?
• 6 Did you have any trouble creating a software RAID 1?

We can't create a software RAID 1 in Windows 7 Home Premium

Software RAID in Windows 7 is nothing less than a mess. Different Windows 7 versions have arbitrary restrictions on which RAID levels they allow us to create.

If we bought a PC with pre-installed Windows 7, we probably have Windows 7 Home Premium. That means that software RAID 1 is out of reach.

Due to licensing reasons, on Windows 7 Home Premium we can only create a RAID 0, "Striping", which is a useless type of RAID for data security.

When one disk fails in the RAID 0, all the data from all the disks is lost, permanently and without any chance of recovery.

The "Spanned Volume" option isn't even RAID. It's a JBOD array (Just a Bunch of Disks), where two or more disks appear as a single large disk. But this too doesn't offer any data security, when one disk is lost, all the data from every disk in the array is lost.

So, we won't be covering either scenario in Windows 7 Home Premium.

Why software RAID 1 and not software RAID 5?

For the same arbitrary licensing reasons, software RAID 5 is completely off-limits to any version of Windows 7.

We will find the option by right-clicking on the drive, but it will always be grayed-out, just taunting us with what it would be...

Only Windows Server editions - as old as Windows 2000 server - can create a software RAID 5.

With RAID 0 being useless for data security and RAID 5 being unavailable, creating a software RAID 1 in Windows 7 is the only viable option.

How to create a software RAID 1 in Windows 7

As we mentioned earlier, on a level 1 RAID two disks have the exact copy of all the data at any single moment. So, when one of them fails, the data is safe on the other.

The downside of RAID 1 is that we lose 50% of the total disk capacity. If we use two 1TB disks for RAID 1, the array will have a 1TB capacity in total.

To create the software RAID, we press the Windows key + R, to open the "Run" dialogue, and type:

diskmgmt.msc

Creating a software RAID 1 with brand new disks

If both of the disks we will use for the Software RAID 1 are brand new, once we open the Disc Management console, we will get a message to initialize the disks.

If the disks are smaller than 2TB each, the MBR partition style is good enough. Else, we need to select the GPT partition style.

After that, we right-click on one of the two unallocated volumes, and select "New Mirrored Volume...".

On the New Mirrored Volume Wizard, we add the 2nd disk...

...which will allow us to move forward.

In theory, we can have more than two disks in a RAID 1 array, but they will all be copies of one disk, and a terrible waste of space. Four 1TB disks in RAID 1 give us a 1TB array, with 75% of the total capacity lost.

Finally, we assign a drive letter to the new array...

...and format it to NTFS.

The system warns us that this operation will convert basic disks to dynamic. The only downside of that is that we can't dual-boot another operating system from a dynamic disk e.g. a Linux distribution or another version of Windows.

By choosing "Yes", our Software RAID 1 in Windows 7 is ready.

We will find it in the "Computer", as a single disk.

Creating a Software RAID 1 copy of an existing data disk or partition

Let's say we didn't buy two more disks but had already a disk or partition containing our data, and bought another disk to create a RAID 1.

In this case, we right-click the NTFS volume and select "Add Mirror...".

The system will show us the new disk, and we click on Add Mirror.

Both the disk we already had and the new disk will be converted to dynamic disks.

The software RAID 1 is created and starts resynching.

As you can see, the original data we had on the single disk isn't lost, and we have complete access to it while the RAID is resynching.

It's best to leave the RAID 1 resynching complete before we do any intensive writing or deleting of data. It is a strenuous procedure for the disks, and we shouldn't make it any harder. Disks are known to have failed during the RAID resynching.

Creating a Software RAID 1 for the Windows installation

Since we don't need to format both drives to create Software RAID 1, we can also create a RAID 1 with the Windows installation. But we shouldn't do this if we wish to dual-boot with another operating system, because of the dynamic disk restrictions we mentioned earlier.

We just need to mirror both the System Reserved partition...

...and the C: partition.

Mind you that if, for some reason, we don't have a "System Reserved" partition, it's impossible to create a bootable software RAID 1, the option will be grayed out.

Now, on each system startup, we will get two boot options, one for each disk.

Both installations are identical, so it doesn't matter if we choose the "secondary plex" one.

What happens when one disk fails in RAID 1

When one of the hard drives does fail, we get a "Failed Redundancy" message at the Disk Management console.

We still have complete access to our data, and nothing is lost provided the other disk still works properly.

Unfortunately, the system doesn't give us any warning whatsoever that one of the disks has failed.

This is a huge oversight, especially if we consider that a Linux Software RAID can send us an email as soon as a disk fails. But that's Microsoft for you.

We must make a habit of checking ourselves the Disk Management console every once in a while, to make sure that RAID 1 is working with both disks and full redundancy.

If we have the Windows installation on RAID 1 and lose the original disk, we will just get a cryptic message when trying to start the plain Windows 7 option.

In this case, we need to reset and choose the secondary plex.

How to fix a collapsed software RAID 1

We must replace the HDD that has failed with a new one, as soon as possible.

Then, before we remake the array, we take a complete backup of any essential data from the working disk, preferably on an external hard drive.

The last thing we want is for the only working disk also to crash while rebuilding the array.

After we have backed up our data, we remove the mirror...

...making sure we have selected the Missing disk...

After that, the missing disk entry will disappear, and we can create the RAID with the new hard drive.

Why choose the Software RAID 1 instead of the motherboards "hardware" RAID?

Most current motherboards boast their RAID controller.

Many users think of this as a "hardware" RAID, and thus a better solution than a software RAID 1 or software RAID 5.

The thing is that motherboard RAID isn't hardware RAID. It is software RAID, run by the BIOS and the Windows drivers.

It's a worse solution than both true software and true hardware RAID, and that is why it is known as Fake RAID. You can read about it in the linked article.

The fact is that we need an expensive hardware RAID controller - upwards of $300-$400 - to get true hardware RAID. Some cheap PCI or PCI-E controllers also use Fake RAID.

All in all, software RAID 1 in Windows 7 is far from perfect, but it is the best way to get RAID 1 on our Windows 7 PC, without paying through the nose for it.