Search
StarWind is a hyperconverged (HCI) vendor with focus on Enterprise ROBO, SMB & Edge

Establish a Site-to-Site VPN between Azure and a Unifi Dream Machine Pro

  • July 9, 2020
  • 7 min read
IT and Virtualization Consultant. Romain is specializing in Microsoft technologies such as Hyper-V, System Center, storage, networking, and MS Azure. He is a Microsoft MVP and MCSE in Server Infrastructure and Private Cloud.
IT and Virtualization Consultant. Romain is specializing in Microsoft technologies such as Hyper-V, System Center, storage, networking, and MS Azure. He is a Microsoft MVP and MCSE in Server Infrastructure and Private Cloud.


A couple month ago, Ubiquiti has released a new all-in-one hardware called Unifi Dream Machine Pro (UDM-Pro). UDM-Pro is great because it handles several features such as router, firewall, switch, SDN or camera management. When I bought UDM-PRO I removed 3 VMs and two equipments.

UDM-PRO embeds a Unifi Controller which is a piece of software that enables to manage several Ubiquiti hardware. It’s an SDN. From Unifi Controller you can handle your whole Ubiquiti network such as switches, firewall and obviously VPN. When I bought UDM-PRO, I wanted to establish a Site-to-Site VPN with Azure for my lab. Thanks to that, I can try hybrid scenarios between On-Premises and Azure. In this topic, we will see how I have established this VPN.

Requirements

To follow this topic, you need an Azure subscription with the following resources deployed:

  • A virtual network
  • A local network gateway
  • A virtual network Gateway

Make sure that a gateway subnet is created in your virtual network:

Subnets

Configure the local network gateway

The local network gateway is used to define the On-Premises network configuration. You need your Public IP and the subnet you want to route in Azure:

vNET-LocalGateway Configuration

In address space field, I specify each subnet I want to route to Azure. Some network such as management doesn’t need to be routed to Azure.

Configure the virtual network gateway

The virtual network gateway is a software gateway deployed in your Azure tenant. Your On-Premises gateway will establish a VPN with the virtual network gateway. When you create your virtual network gateway you just have to choose the SKU. Microsoft gives detail about difference between SKU here.

Configure the virtual network gateway

For the purpose of my lab, I chose the VpnGw1 SKU. You can also configure BGP to spread route automatically between On-Premises and Azure.

Once the virtual network gateway is ready, you need to create a Connections. To create a connection, just navigate to Connections and click on Add.

Connections

You need to specify a name and shared key to create a connection. Moreover, select the right local network gateway to establish the Site-to-Site VPN between your On-Premises and Azure.

Add Connection

Configure the UDM-PRO

Connect to the Unifi Controller. It should be your UDM-PRO IP or name. Open the settings and navigate to VPN connections. Click on Create New VPN Connection.

Configure the UDM-PRO

Even if it’s not a Unifi to Unifi VPN, select Create Unifi to Unifi VPN. It’s a UI glitch:

Unifi VPN

Then select Manual IPSec and specify the following configuration:

  • Remote Subnet: Azure subnet that will be routed On-Premises
  • Route Distance: number of hops allowed
  • Interface: specify the WAN interface
  • Peer IP: Public IP address of the virtual network gateway (Azure)
  • Local WAN IP: Your public IP address (On-Premises)
  • Pre-Shared Key: Copy past the one you have specified in the Connections creation wizard (Azure)
  • IPsec Profile: Azure Dynamic routing

Manual IPSec

By selecting Azure Dynamic routing, the advanced settings should be set automatically as below:

Advanced settings

Test of the VPN connection

Do not look at the Unifi Controller to check if the VPN is established. In my lab it’s working but the Unifi Controller dashboard indicates the Site-to-Site VPN down:

Test of the VPN connection

To check if the VPN is established, open the Azure portal, and look at the Connections:

Check if the VPN is established

You can also make a ping from an On-Premises server to an Azure service:

Ping from an On-Premises server

Hey! Found Romain’s article helpful? Looking to deploy a new, easy-to-manage, and cost-effective hyperconverged infrastructure?
Alex Bykovskyi
Alex Bykovskyi StarWind Virtual HCI Appliance Product Manager
Well, we can help you with this one! Building a new hyperconverged environment is a breeze with StarWind Virtual HCI Appliance (VHCA). It’s a complete hyperconverged infrastructure solution that combines hypervisor (vSphere, Hyper-V, Proxmox, or our custom version of KVM), software-defined storage (StarWind VSAN), and streamlined management tools. Interested in diving deeper into VHCA’s capabilities and features? Book your StarWind Virtual HCI Appliance demo today!