> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix Gateway to Azure VPN Gateway

> This document describes how to configure Site2Cloud IPsec tunnels between an Aviatrix Gateway and an Azure Virtual Network Gateway (VNG).

This document describes how to configure Site2Cloud IPsec tunnels between an
Aviatrix Gateway and an Azure Virtual Network Gateway (VNG).

## Configuration Workflow

Before you begin, ensure you have the latest Controller software.

1. In Aviatrix CoPilot, go to **Cloud Fabric > Gateways > Specialty Gateways** tab. From **+ Gateway** dropdown menu, select **Other**, then create a gateway.
2. At the Azure portal, go to the Virtual network gateways page. Fill in
   the following information to create a new Virtual Network Gateway:

| Name            | Description                                                         |
| --------------- | ------------------------------------------------------------------- |
| Name            | Enter a name for the Azure VPN gateway (for example, Azure-VPN-GW). |
| Gateway type    | VPN                                                                 |
| VPN type        | Policy-based                                                        |
| SKU             | Basic                                                               |
| Location        | Select a desired location.                                          |
| Virtual network | Select a desired VNet.                                              |

<Note>
  Azure is [deprecating the Basic Load Balancer](https://learn.microsoft.com/en-us/answers/questions/1033471/retirement-announcement-basic-load-balancer-will-b) in September 2025. You can <a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/migrate-lb-sku"}>migrate to the Standard SKU Load Balancer</a>.
</Note>

3. Once the virtual network gateway is provisioned, record its Public IP
   address.

4. In Aviatrix CoPilot, create a [Static Policy-Based (Unmapped) external connection](https://legacy.docs.aviatrix.com/documentation/latest/network/external-connection-create-static-policy-based-unmapped.html).

5. Once the Site2Cloud connection is created, locate the same connection on the **External Connections (S2C)** page.

6. Click the vertical ellipsis <img src="https://mintcdn.com/aviatrix-14b37c43/VY6W0iTAMUQkrobS/images/security/threedot.png?fit=max&auto=format&n=VY6W0iTAMUQkrobS&q=85&s=9498dd71f99faa81563f9d3f0baf4463" alt="25" style={{display: 'inline', verticalAlign: 'middle', height: '1em'}} width="24" height="34" data-path="images/security/threedot.png" /> icon and select **Download Configuration**.

7. The Download Configuration dialog displays. Select the following values for each specific
   field:

   * Vendor: Generic
   * Platform: Generic
   * Software: Vendor Independent

8. Click **Download**.

9. Collect the following information from the downloaded configuration template:

| Pre-Shared Key from #1                          | Internet Key Exchange Configuration |
| ----------------------------------------------- | ----------------------------------- |
| Aviatrix Gateway Public IP from #3              | Tunnel Interface Configuration      |
| Cloud Network(s) from the Subnets section of #3 | Tunnel Interface Configuration      |

10. At the Azure portal, go to the **Local network gateways** page. Enter the
    following information to create a local network gateway:

| Name                   | Description                                                |
| ---------------------- | ---------------------------------------------------------- |
| Name                   | Enter a local gateway name (e.g. AVX-GW)                   |
| IP address             | Enter the Aviatrix Gateway's public IP collected at Step 6 |
| Address space          | Enter the "Cloud Network" CIDR collected at Step 6         |
| Configure BGP settings | Unmark this checkbox                                       |

11. At Azure portal, go to **Virtual network gateways** page and select the
    gateway created at Step 2.
12. Select **Connections** from **Settings**. Enter the following information
    to create a connection:

| Name                    | Description                                      |
| ----------------------- | ------------------------------------------------ |
| Name                    | Enter a VPN connection name (e.g. Azure-AVX-S2C) |
| Connection type         | Select **Site-to-site (IPsec)**                  |
| Virtual network gateway | Select the VPN gateway created at Step 2         |
| Local network gateway   | Select the local gateway created at Step 7       |
| Shared key (PSK)        | Enter the pre-shared key collected at Step 6     |

## Troubleshooting

To check a tunnel state, go to the **Networking > Connectivity > External Connections (S2C)** tab. There should be a green dot next to the name of the external connection.

To troubleshoot a tunnel state, go to <a href={"/docs/enterprise/" + "10.1" + "/reference/ui/diagnostics/diagnostic-tools"}>Diagnostics > Diagnostic Tools > Connectivity Diagnostics</a>.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/guides/connectivity/gateways/external-connection-settings"}>About External Connection Settings</a>

* <a href={"/docs/enterprise/" + "10.1" + "/guides/uservpn/migrate-lb-sku"}>Migrating to Standard Load Balancer SKU</a>