Vigor3900 to Microsoft Azure - Dynamic Routing - IKEv2

Support Model : Vigor3900

Vigor3900 supports IKEv2 since firmware version 1.3.0, now, we have the ability to connect Vigor3900 and Microsoft Azure Server by the IKEv2 tunnel.

This document introduces how to set up IPsec tunnel between Vigor3900 and Microsoft Azure Server in Dynamic Routing mode.


Microsoft Azure Server Setup

1. Create your virtual network. In the lower left corner of the screen, click New

Creating Virtual Network on Azure Server    

2. In the navigation panel, click Network Services >> Virtual Network >> Custom Create to begin the configuration wizard.

Start Configuration Wizard    

3. Name your virtual network, select the location and then click Next.

Naming the virtual network    

4. Check Configure a site-to-site VPN, select Specify a New Local Network and then click Next.

Configuring Site-to-Site VPN    

5. Name the local network (it is the local network of Vigor3900 in this example) and then input VPN Device IP Address (should be the IP address of the Vigor3900 used to create VPN to Azure). The VPN device CANNOT be located behind a NAT.

Site-to-Site VPN settings on Azure server    

6. Create Virtual Network Address space for Azure. In this example, we will add two networks for Azure. One is and the other is Then click add gateway subnet.

Creating Virtual Network Address for Azure Server    

7. Azure will specify the Gateway Subnet automatically, click Finish to save the Virtual Network Settings.

Gateway Subnet specified automatically    

8. Virtual network "Vivian_Azure_Test" is now created.

Virtual Network created    

9. Create Gateway and manage Keys.

a. Click Create Gateway, then select Dynamic Routing.

Creating Gateway with Dynamic Routing    

b. A message will appear asking Do you want to create a gateway for virtual network "Vivian_Azure_Test". Click Yes to begin creating the gateway. It might take around 15 minutes for the gateway to create. After that, we will see the Gateway IP address! It is the Internet IP that Azure will use to create VPN to Vigor3900.

Confirm creating gateway    

10. Click Manage Key, then we can get the IPsec Pre-shared. Copy this key and paste this key to the VPN profile for Azure on Vigor3900.

Get the IPsec Pre-Shared Key    



Vigor3900 VPN Profile Setup

11. Create IPsec VPN profile on Vigor3900 for Microsoft Azure.

a. Open VPN and Remote Access >> VPN profiles >> IPsec page and then click Add.

b. Enable this VPN profile.

c. Input Vigor3900's local IP in Local IP /Subnet Mask.

d. Input Azure Gateway IP as the Remote Host IP.

e. Input Azure Virtual Network Address Space as the Remote IP/ Subnet Mask. (in step 1e)

f. Select IKEv2 as IKE Protocol. (Azure Dynamic Routing uses IKEv2)

g. Paste the Pre-Shared Key we copied from step 10.

h. Apply the settings.

Creating a IKEv2 VPN profile on Vigor3900    



Establish IPsec Tunnel

12. After configuring the VPN profile on Vigor3900, we can click CONNECT on Azure to create the IPsec tunnel.

Connecting IKEv2 on Azure server    

13. IPsec tunnel is established.

Showing statistics of IKEv2 VPN tunnel    

14. We are able to ping Azure Virtual Network Gateway IP from a PC behind Vigor3900.

Checking IKEv2 VPN connectivity through Ping test    

15. We may check the VPN status on VPN Connection Management page.

Vigor3900 show the IKEv2 VPN connected successfully    
Was this article helpful?
33Vigor3900 to Microsoft Azure - Dynamic Routing - IKEv2 has been viewed------ 33 ------times.