How to create a site-to-site VPN link between a Draytek router and Microsoft Azure

I’m currently in the process of Migrating a customer from an on-premise Windows Server 2003 Small Business Server to an Azure based Windows Server 2012 r2 Datacenter with Windows Server Essentials experience installed.

Part of that migration process is clearly going to involve moving all of the shared data from the current server into Azure. This customer has a Draytek 2860, which although not an officially support Azure device has no problems connecting to Azure.

The main frustration I found when building the site-to-site connectivity between Azure and the Draytek firewall is that neither end has any useful log files that you can look at to aid in troubleshooting, it either works or it doesn’t. Having been through the same exercise recently using a SonicWALL firewall which has extensive logging the process is much easier.

Anyway, here is how to do it. Because I am somewhat new to Azure, and I am assuming that others reading this will be to, I am going to go through the steps required to build the virtual network from scratch and eventually join the Draytek router on.

Create the Azure Virtual Network

Login to Azure and create a new virtual network that is going to link to your Draytek router:

CreateAzureNetwork

 

I’ve chose to create my network in the “North Europe” data center location as I am based in the UK and I believe that North Europe is in Dublin, Ireland.

Next I ticked the box to “Configure a site-to-site VPN”, but here is an important note, do NOT tick the box that says “Configure a point-to-site VPN”. If you do this then the Azure network will use dynamic routing instead of static routing and you will not be able to get your Draytek to connect. (If you do manage to, please let me know how you did as I spent a while trying to get it to work!).

Create site-to-site connectivity between Azure and a Draytek Router

On the next screen you will have to name your local network and specify the public IP address of your Draytek router. In addition you will need to tell Azure the details of your local subnet.

In my case the existing local network is a 192.168.250.0/24.

Defining the local network properties for linking to an Azure virtual network

Moving on to the next screen you will define the parameters of the virtual network:

Details of Azure Virtual Network

 

After you have defined a subnet for use in Azure you will need to click on “Add gateway subnet”.

Once you are all done click on the tick to finish the virtual network creation process.

Wait a short time and you should see when the virtual network has been created. Once the network has been created you can go into the network dashboard and finish off the remaining steps.

Your virtual network dashboard will probably look something like this:

Azure Virtual Network Dashboard without a gateway created

Click on the “Create Gateway” button to make an external interface to your Azure Virtual Network. Again making sure to select “Static Routing” in order for it to work with your Draytek router.

Creating a Microsoft Azure Static routing gateway

You will see the gateway being created, it took about five minutes to complete for me:

Creating a Microsoft Azure Virtual Network Gateway to link to an on-premise Draytek Router

When the creation is done you will see the gateway details displayed like this:

Azure Virtual Network Gateway Created

You need to make a note of the gateway IP address and the virtual network preshared key. Click on the “Manage Key” button on the bottom of the dashboard and the gateway key will be displayed, make a note of it as you need to enter this into your Draytek Router:

Azure Gateway Preshared Key

 

Now you have completed all the steps required at the Azure end, time to head over to your local Draytek.

Define a VPN profile on your Draytek router to create a site-to-site link to Microsoft Azure

Once logged in to your Draytek head to “VPN and Remote Access” and then “LAN to LAN”. Choose an empty profile to begin the configuration.

Give your VPN Profile a name, and set the call direction to “Dial-Out”. Tick the “Always on” check-box.

Defining Dial Out settings for Draytek router connecting to Azure virtual network

In the 2nd section enter the gateway IP address, enter the preshared key by clicking on the “IKE Pre-Shared Key” button and set the IPSec Security Method to “High(ESP)” and “AES with Authentication”

Defining IPSEC Details for Draytek router to connect to Azure Virtual Network

Ignore sections three and four and move on to the bottom section 5.

Set the correct details network addresses for your remote Azure virtual network and your local network:

Define network details for VPN connection between Azure and a Draytek Router

Save the profile by clicking on OK and then go to “VPN and Remote Access” again and then to “Connection Management”.

All being well you should now see that your Draytek router has a connection to Azure:

Draytek router showing site-to-site connection to a Microsoft Azure Virtual Network

As you can see, the latency from my connection to the Azure network is pretty low. This is a ping to a Windows Server 2012 VM running inside the newly created Virtual Network:

Pinging a virtual machine inside an Azure Virtual Network

I also uploaded a file to a drive on the Azure virtual machine and downloaded it again to test transfer speeds. Clearly there is nothing scientific about this and it is totally dependent on your on broadband connection speed, but merely for my own curiosity:

Uploading a file to  Windows Azure Virtual machine over a site-to-site VPN link

I consistently got around 1.75MB/second upload, which is pretty much the entire upload capacity of my broadband line.

I downloaded the same file from Azure and got these speeds:

Copying a file from an Azure VM over a site-to-site link using a Draytek Router

The speed downloading from Azure was faster than the upload, but not all that fast really. I have an 80mb connection and would expect Azure to push data out quicker than that, so I checked the CPU usage on the Draytek.

Without utilizing the Azure site-to-site link my Draytek shows around 7% CPU usage:

Screenshot of Draytek CPU usage when router is more or less idle

When downloading a file from Azure the CPU usage shoots up to around 80%, so I am wondering if the CPU in the Draytek is a limiting factor when communicating with Azure:

Draytek CPU usage when copying a file from Azure

I will try the same test with a SonicWALL NSA 220 to see if the same test produces quicker results.

How to enable Flash Player on Windows Server 2012 r2

If you are trying to view web pages that contain flash content on Windows Server 2012 r2 then you may find that it does not work. You are then led to a page on the Adobe website tells you that Flash player is already installed on Windows 8 and that you do not need to install it. This post explains how to enable Flash Player on Windows Server 2012.

Message from Adobe Website informing you that Flash Player is already installed on Windows Server 2012 r2   The page then goes on to provide instructions as to how to enable Flash, this basically consists of:

  • Ensuring that the flash player add-on is enabled.
  • Checking that Active-X filtering is disabled.

You will probably find that these instructions do not work for you as flash player is not listed in the Internet Explorer Add-ons.

How to install Flash Player on Windows Server 2012 r2

In order to install Flash Player on Windows Server 2012 you need to install the Desktop Experience Feature. To do this, do the following:

  • Go into server manager.
  • Click add roles and features: Using server manager to install flash player on Windows Server 2012
  • Press next until you reach the “Features” page.
  • Tick the box “Desktop Experience” which is hidden under the “User Interfaces and Infrastructure” feature: Installing the desktop experience to enable Flash player in Windows Server 2012
  • You will then have to accept the installation of some other features to support the installation of desktop experience
  • The features are installed and the server is rebooted: Desktop Experience Feature being installed on Windows Server 2012 r2

Or if you prefer, you can install with the simple but so effective Windows Powershell command:

Install-WindowsFeature Desktop-Experience

The reason I wanted to have access to Flash Player on this particular server was so that I could access the vSphere Web client, which uses flash. Hope this helps someone.