How to create a site-to-site VPN link between a Draytek router and Microsoft Azure

I’m currently in the process of Migrating a customer from an on-premise Windows Server 2003 Small Business Server to an Azure based Windows Server 2012 r2 Datacenter with Windows Server Essentials experience installed.

Part of that migration process is clearly going to involve moving all of the shared data from the current server into Azure. This customer has a Draytek 2860, which although not an officially support Azure device has no problems connecting to Azure.

The main frustration I found when building the site-to-site connectivity between Azure and the Draytek firewall is that neither end has any useful log files that you can look at to aid in troubleshooting, it either works or it doesn’t. Having been through the same exercise recently using a SonicWALL firewall which has extensive logging the process is much easier.

Anyway, here is how to do it. Because I am somewhat new to Azure, and I am assuming that others reading this will be to, I am going to go through the steps required to build the virtual network from scratch and eventually join the Draytek router on.

Create the Azure Virtual Network

Login to Azure and create a new virtual network that is going to link to your Draytek router:

CreateAzureNetwork

 

I’ve chose to create my network in the “North Europe” data center location as I am based in the UK and I believe that North Europe is in Dublin, Ireland.

Next I ticked the box to “Configure a site-to-site VPN”, but here is an important note, do NOT tick the box that says “Configure a point-to-site VPN”. If you do this then the Azure network will use dynamic routing instead of static routing and you will not be able to get your Draytek to connect. (If you do manage to, please let me know how you did as I spent a while trying to get it to work!).

Create site-to-site connectivity between Azure and a Draytek Router

On the next screen you will have to name your local network and specify the public IP address of your Draytek router. In addition you will need to tell Azure the details of your local subnet.

In my case the existing local network is a 192.168.250.0/24.

Defining the local network properties for linking to an Azure virtual network

Moving on to the next screen you will define the parameters of the virtual network:

Details of Azure Virtual Network

 

After you have defined a subnet for use in Azure you will need to click on “Add gateway subnet”.

Once you are all done click on the tick to finish the virtual network creation process.

Wait a short time and you should see when the virtual network has been created. Once the network has been created you can go into the network dashboard and finish off the remaining steps.

Your virtual network dashboard will probably look something like this:

Azure Virtual Network Dashboard without a gateway created

Click on the “Create Gateway” button to make an external interface to your Azure Virtual Network. Again making sure to select “Static Routing” in order for it to work with your Draytek router.

Creating a Microsoft Azure Static routing gateway

You will see the gateway being created, it took about five minutes to complete for me:

Creating a Microsoft Azure Virtual Network Gateway to link to an on-premise Draytek Router

When the creation is done you will see the gateway details displayed like this:

Azure Virtual Network Gateway Created

You need to make a note of the gateway IP address and the virtual network preshared key. Click on the “Manage Key” button on the bottom of the dashboard and the gateway key will be displayed, make a note of it as you need to enter this into your Draytek Router:

Azure Gateway Preshared Key

 

Now you have completed all the steps required at the Azure end, time to head over to your local Draytek.

Define a VPN profile on your Draytek router to create a site-to-site link to Microsoft Azure

Once logged in to your Draytek head to “VPN and Remote Access” and then “LAN to LAN”. Choose an empty profile to begin the configuration.

Give your VPN Profile a name, and set the call direction to “Dial-Out”. Tick the “Always on” check-box.

Defining Dial Out settings for Draytek router connecting to Azure virtual network

In the 2nd section enter the gateway IP address, enter the preshared key by clicking on the “IKE Pre-Shared Key” button and set the IPSec Security Method to “High(ESP)” and “AES with Authentication”

Defining IPSEC Details for Draytek router to connect to Azure Virtual Network

Ignore sections three and four and move on to the bottom section 5.

Set the correct details network addresses for your remote Azure virtual network and your local network:

Define network details for VPN connection between Azure and a Draytek Router

Save the profile by clicking on OK and then go to “VPN and Remote Access” again and then to “Connection Management”.

All being well you should now see that your Draytek router has a connection to Azure:

Draytek router showing site-to-site connection to a Microsoft Azure Virtual Network

 

Draytek 2860 site-to-site VPN to Azure Performance

As you can see, the latency from my connection to the Azure network is pretty low. This is a ping to a Windows Server 2012 VM running inside the newly created Virtual Network:

Pinging a virtual machine inside an Azure Virtual Network

I also uploaded a file to a drive on the Azure virtual machine and downloaded it again to test transfer speeds. Clearly there is nothing scientific about this and it is totally dependent on your on broadband connection speed, but merely for my own curiosity:

Uploading a file to  Windows Azure Virtual machine over a site-to-site VPN link

I consistently got around 1.75MB/second upload, which is pretty much the entire upload capacity of my broadband line.

I downloaded the same file from Azure and got these speeds:

Copying a file from an Azure VM over a site-to-site link using a Draytek Router

The speed downloading from Azure was faster than the upload, but not all that fast really. I have an 80mb connection and would expect Azure to push data out quicker than that, so I checked the CPU usage on the Draytek.

Without utilizing the Azure site-to-site link my Draytek shows around 7% CPU usage:

Screenshot of Draytek CPU usage when router is more or less idle

When downloading a file from Azure the CPU usage shoots up to around 80%, so I am suspect the CPU in the Draytek is a limiting factor when communicating with Azure:

Draytek CPU usage when copying a file from Azure

SonicWALL TZ210 site-to-site VPN to Azure Performance

I had an old SonicWALL TZ210 sitting around so I configured that to connect to Azure instead and did the same tests and saw the following speeds performing the same operation:

Screenshot of file copy operation from Windows Azure to local network using a SonicWALL TZ210 to create the site-to-site link

 

As you can see the SonicWALL is significantly faster than the Draytek despite being an old model. I also plan to try out a SonicWALL NSA 220, the quoted VPN throughput figures are:

  • Draytek 2860 – 50Mbps
  • SonicWALL TZ210 – 75Mbps
  • SonicWALL NSA 220 – 150Mbps

The VPN performance is a really important factor to consider when choosing what device to use to connect to Azure, with internet connections becoming increasing fast you might be surprised to find that your existing device may not have enough muscle to handle your full bandwidth.

4 thoughts on “How to create a site-to-site VPN link between a Draytek router and Microsoft Azure

  1. Really good article, thanks but when using the DrayTek 2860n (UK) router it always shows the VPN as offline and in Azure it says connecting…, it never ever connects, any idea what I might be doing wrong.

  2. Following this article (very good one) trying to configure my Draytek 2820 without success. No other forums have the answer for this problem, but the solution is simple:
    In “Ike Security Info” > Advanced make sure “IKE phase 1 proposal” is “AES128_SHA1_G2” and “IKE phase 2 proposal” is “AES128_SHA1”.
    That’s it ! Get my VPN up.
    Regards

Leave a Reply

Your email address will not be published. Required fields are marked *