Setting up software based Site-to-Site VPN for Windows Azure with Windows Server 2012 Routing and Remote Access

A follow-up post is available with a complete reference implementation: Reference implementation: Creating a hybrid cloud with Windows Azure Virtual Networks software based Site-to-Site VPN

Two days ago, only one week after Virtual Machines and Virtual Networks reached general availability, Scott Guthrie already announced a few new improvements to Virtual Machines and Virtual Networks. One of the big changes for Virtual Networks is the support for software based Site-to-Site VPN based on the Routing and Remote Access role available in Windows Server 2012.

Let’s take a look at how easy it is to setup a Site-to-Site VPN with RRAS based on a customer case. Contoso is a company with a datacenter in Belgium (Brussels). For a marketing campaign the created a new application and because they needed a quick time-to-marked they decided to deploy it on a few Windows Azure Virtual Machines in the Western Europe datacenter. These machines connect to some of their systems like the intranet, their Oracle database, … For security reasons they didn’t want to make these systems available through the internet, so that’s why they decided to setup a Site-to-Site VPN between their on-premises network (the datacenter in Brussels) and the Virtual Machines running in Windows Azure.

Works on my machine!

Before we start we’ll need to see if our network matches the requirements:

Defining the local network

The first thing we need to do is define the local network (this would be our on-premises network). This can be done on the portal under the Networks option by clicking the New button:

After that simply define the name, the address space and the public IP of your server:

Creating the Virtual Network

Now go ahead and create a new Virtual Network. On the second page you’ll need to enable the Configure Site-To-Site VPN option. This is where you get to choose the local network:

On the next page you’ll simply need to define a gateway subnet and you’ll be able to complete the wizard. After a few seconds the Virtual Network will have been created.

Setting up the gateway

After the Virtual Network has been created you’ll need to setup the gateway. At the moment static routing is not supported for RRAS so you’ll need to create a gateway with dynamic routing (

And now  you’ll need to wait a few minutes. Once you’re done waiting you can download the VPN Device Script.

VPN Device Script

When you click the Download VPN Device Script link you’ll see the following dialog:

This is where you’ll get to choose RRAS. After downloading the script you might need to fix a small issue. When I downloaded the script (I tried several times) it looked like something was wrong with the file. Take a look at it:

It looks like double quotes have been replaced with a little square. Maybe an encoding issue? Just replace them with double quotes with any text editor (I’m using Notepad++) and you’re ready to continue. Now you’ll need to modify a few variables:

  1. Line 75: Replace <SP_AzureGatewayIpAddress> with the IP address of your gateway (the big IP address you’ll find on the portal)
  2. Line 75: Replace <SP_AzureNetworkCIDR> with the network CIDR you defined when creating the new Virtual Network (in my case this was
  3. Line 75: Replace <SP_AzureNetworkMetric> with your network metric (I used 10)
  4. Line 78: Replace <SP_AzureGatewayIpAddress> with the IP address of your gateway (the big IP address you’ll find on the portal)
  5. Line 79: Replace <SP_AzureGatewayIpAddress> with the IP address of your gateway (the big IP address you’ll find on the portal)
  6. Line 85: Replace <SP_AzureGatewayIpAddress> with the IP address of your gateway (the big IP address you’ll find on the portal)

Finally save the file as a *.ps1 file and execute it on your server. This will install (if not present) RRAS and configure the site to site VPN:

Now the error you see here isn’t a real issue. It looks like the server wasn’t ready configuring RRAS when we executed the script. Wait a few seconds and open RRAS to see the result (the interface should have connected by now):

Connecting both Sites

You’re done! Go back to the portal, open the Virtual Network and press the Connect button. After a few seconds the Site-to-Site VPN between your on-premises network and your Virtual Network will be running:

And the link is working! Now you can go ahead and configure whatever needs to be configured in RRAS (routing to specific parts of your network for example).


About Sandrino Di Mattia

Sandrino Di Mattia is a Customer Success Engineer at Auth0 and a Microsoft Azure MVP.

  • Derek

    I can’t seem to get connected. How can I verify that protocol 50 is supported on my ISP connection?

  • Sivaraman

    we have RRAS available on windows server 2008r2 onward, can we use the same for site-to-site vpn??

  • Mateusz H


    Great post, also check out cours on Microsfot Virtual Academy.
    Microsoft Azure: Site-to-Site VPN,

  • Swati Sharma

    MS-Azure gives variant hosting shape for executing applications. Each one gives variant bunch of services,
    & so which one you select fall under on closely what you are annoying to
    do. It is a cloud computing program
    & infrastructure for position, & managing applications & services
    via global link or network.

  • JavierTI

    Hello Sandrino,

    I see that there is no need to modify the file, but even so I get the same warning after running the script.

    My question is which means that IP to miss out on the error (for me it is another). It is an IP that is not my Azure Gateway and IP issues in my network?

    Please reply. Thank You.