Loading ...

Setup Azure to Unifi USG IPSec VPN

Posted in : Azure, Ubiquiti, VPN
32 thoughts on “Setup Azure to Unifi USG IPSec VPN

Found a recent issue when troubleshooting this with a reader of this blog. If there are any other VPN connections setup behind the USG device and there are port forwarding rules for these, then the Azure site will not connect properly. Need to remove these rules then remove the Azure “Connection” and recreate it.

Reply

Just set this up with a USG Pro and connecting to Azure. Worked great the first time. Thanks for the great guide.

Reply

Glad to hear that this blog is helping someone.

Reply

Thanks for the guide! Helped me get setup.

Does anyone have any issues with the VPN dropping to Azure? I’ve setup DPD and its still disconnecting once every few days.

Reply

Hi, I followed this guide and it really helped, azure connected to my primary usg. However, I had a site to site vpn to another usg that had been working fine. That vpn has stopped working all together. Can you have two site to site vpn’s in harmony with Azure?

Reply

To connect multiple USG’s to a single Azure instance you will need to create a Route-based VPN. Look up your options here:

https://docs.microsoft.com/en-gb/azure/vpn-gateway/vpn-gateway-about-vpn-devices

IT looks like Ubiquiti has some good documentation on manually creating the route-based VPN here:

https://help.ubnt.com/hc/en-us/articles/115012305347

This will not work via the controller though. Any updates from the controller would wipe out the VPN coding.

Reply

I followed this step by step. I am getting the following error
Dropped due to Traffic Selector Mismatch

I’m assuming it’s my comcast business modem/router. I added my USG to the DMZ on the router but still cannot figure out why this is going on. Any advice?

Reply

I would check the modem / router to see if it has a BRIDGE mode that can be used instead. That will bypass any routing functionality and allow traffic directly through.

Reply

Thanks a lot for the detailed guide. I followed the steps, however on Azure side, the status is always indicating “connecting” and never reached “connected”

What could be the issue..?

Cheers

Reply

Troubleshot this with another tech recently, we found that the issue was with their Azure Address Space being a 10.0.0.0/24 subnet instead 10.0.0.0/16 subnet. We also then had to changed remote subnet on USG to Azure Gateway Subnet. That got the tunnel connected. Once connected we had to add the Primary Azure Subnet that contained the VMs they were trying to connect to on the USG remote subnet section.

Reply
Gaston Ndoumbe Mbey

Hello gents
Is it possible to add a second public IP in the same von gateway to assure a kind of High availability

Reply

Would have to be a secondary tunnel. Not thinking this is possible.

Reply

Thank you for guide. I came across the same problem that iTikoz had. Status is always “connecting”.

Did anyone find the source of this problem ?

Reply

Troubleshot this with another tech recently, we found that the issue was with their Azure Address Space being a 10.0.0.0/24 subnet instead 10.0.0.0/16 subnet. We also then had to changed remote subnet on USG to Azure Gateway Subnet. That got the tunnel connected. Once connected we had to add the Primary Azure Subnet that contained the VMs they were trying to connect to on the USG remote subnet section.

Reply

I followed your steps exactly and have been unable to get the VPN to work. Not sure whats going on and need assistance.

Reply

I would love the chance to troubleshoot this with someone. Feel free to call and we can work it out.

Reply

I also had the issue as others that the VPN was established, but trafic wasn’t going through.
What was needed to solve the problem was to enable dynamic routing on the USG (last checkbox at the bottom).

Reply

I have followed this and the Azure is showing as connected however I cannot get any traffic to flow. I try pinging to and from the Azure VM and cannot see it or the local machines. Any assistance that you could offer would be greatly appreciated.

Reply

Happy to help if you want to show me your config. Did you do the exact same everything that is in the post or did you modify anything?

Reply

I followed everything in the post plus
i tried a couple of things i saw you had added in the comments.
How do I attache files to send you here or should i use the support email.

Reply

I have followed the post except I gave them names that were more appropriate. I even used the IP addresses recommended. I just went over everything and I cannot see an error. How do I attach my config or do I email it to you at support@farmhousenetworking.com. Thanks

Reply

I have reread your comments and found that I needed to also add the 10.10.10.0/24 subnet to the USG and now I can ping the local network from the VM now but not the VM from the local network.

Reply

I feel rather stupid when I turned off the VM firewall I could ping the VM from the local network.

Reply

Glad you got it sorted.

Reply

Has anyone managed to get a USG to Azure S2S VPN working behind a cable router (virgin media) running in modem mode. I’m not getting a connection. It may be because of NAT I suspect so I tried the command “set vpn ipsec site-to-site peer authentication id “ to test but still no luck?

Reply

It is because of the modem being in “modem mode” and not in bridge mode. Data has to flow through to the Ubiquiti unaltered for the VPN handshake to occur successfully. The external IP address of the network has to be recognized as being on the Ubiquiti router.

Reply

Good morning! I am very new to working with Ubiquiti. In reading your post, do you have to modify the JSON file to get the VPN to work? If not, is it just adding the new VPN Site-to-Site network with the corresponding Azure info?

Reply

No fancy JSON editing to make the Ubiquiti USG to Azure VPN to work. Just make sure to follow the example. If you need help then let me know.

Reply

Any way to make this work with 2 wan connections and failover the vpn tunnel to azure?

Reply

Nope. Not with Azure. If both WAN were static IP addresses and you configured two different VPN connections to Azure, then… but the VPN tunnels are point to point, not point to multi-point. I would stick with the no answer here.

Reply

Great article. Q: I have three sites using USGs and I hope to join each to Azure over VPN for Active Directory authentication only. There will be no VMs in the cloud. Earlier in this thread, it was suggested that this would require route-base VPN. Can you confirm this is required for my purposes before I begin learning how to create route-based?
Thanks

Reply

It is route based. In this situation you would be creating three separate VPNs in Azure with separate subnets for each VPN tying into the network on Azure. If you need further help then feel free to send me an email.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Categories

Evaluation Signup

    Something went wrong, try refreshing and submitting the form again.