You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Hybrid Lab Setup using Hyper-V and Azure Site-2-Site VPN
2
2
3
+
A hybrid lab setup combines on-premises infrastructure with cloud resources to create a flexible and scalable environment for testing, development, to **mimic** production workloads. Azure Site-to-Site VPN extends your on-premises network to Azure, enabling secure and seamless communication between your on-premises environment and Azure resources.
3
4
4
-
5
-
## Prereqs
5
+
**In this setup:**
6
6
7
-
- 1 or 2 Azure subscriptions (VSE or Trial will work)
8
-
- Windows OS that will support Hyper-V (UEFI or TPM not needed)
9
-
- Router with S2S IPSEC VPN capabilities __OR__ VyOS Router
10
-
- This lab uses a virtual router called VyOS. The ISO can be found [**here**](https://s3.amazonaws.com/s3-us.VyOS.io/VyOS-1.1.8-amd64.iso). The script will auto download it
11
-
- Home router is issuing IP (DHCP)
12
-
- SSH utility with SCP and SSH-Keygen. These are installed with Git for Windows. You can get it [**here**](https://git-scm.com/downloads)
1. Hyper-V: These script will install and configure Hyper-V on your "on-premises host" or workstation to create and manage virtual machines. These VMs can mimic various server roles, applications, or network configurations that you want to test or deploy.
8
+
2. Azure Site-to-Site VPN: These script will configure a Site-to-Site VPN connection between your on-premises network and Azure Virtual Network. This VPN connection ensures that your on-premises resources can securely communicate with Azure resources over the Internet as if they are part of the same network.
15
9
16
-
## Scripts
10
+
**Benefits of this setup include:**
17
11
18
-
-**configs.ps1**. <-- This script is used to answer script values; linked to all scripts
19
-
-_Advanced:_ You shouldn't have to change to much in the hashtables; recommend only changing the variable at top of script.
20
-
- All scripts use this as an answer file for each setup. The answers are loaded in hashtable format and all of the required values are generated dynamically or will be prompted during execution
21
-
- There are few things you should change on the top section:
22
-
23
-
```powershell
24
-
$LabPrefix = 'contoso' #identifier for names in lab
12
+
-**Scalability**: Easily add or remove virtual machines in Hyper-V or Azure based on your needs without significant hardware investments.
13
+
-**Flexibility**: Test different scenarios or configurations in a sandboxed environment without affecting your production infrastructure.
14
+
-**Security**: Securely connect your on-premises network to Azure using Site-to-Site VPN, ensuring data encryption and compliance with organizational security policies.
25
15
26
-
$domain = 'lab.contoso.com' #just a name for now (no DC install....yet)
16
+
Overall, a hybrid lab setup using Hyper-V and Azure Site-to-Site VPN provides a powerful and flexible solution for testers looking to simulate a true on-premises and cloud resources effectively.
27
17
28
-
$Email = '' #used only in autoshutdown (for now)
18
+
The script will setup whats in red:
19
+
29
20
30
-
#this is used to configure default username and password on Azure VM's
31
-
$VMAdminUser = 'xAdmin'
32
-
$VMAdminPassword = '<password>'
33
21
34
-
#NOTE: Make sure ALL subnets do not overlap!
35
-
$OnPremSubnetCIDR = '10.120.0.0/16' #Always use /16
36
-
$OnPremSubnetCount = 2
37
-
38
-
$RegionSiteAId = 'SiteA'
39
-
$AzureSiteAHubCIDR = '10.23.0.0/16' #Always use /16
40
-
$AzureSiteASpokeCIDR = '10.22.0.0/16' #Always use /16
41
-
42
-
$RegionSiteBId = 'SiteB'
43
-
$AzureSiteBHubCIDR = '10.33.0.0/16' #Always use /16
44
-
$AzureSiteBSpokeCIDR = '10.32.0.0/16' #Always use /16
45
-
46
-
$DHCPLocation = '<IP, server, or router>' #defaults to DHCP server not on router; assumes DHCP is on a server
47
-
#if <router> is specified, DHCP server will be enabled but a full DHCP scope will be built for each subnets automatically (eg. 10.22.1.1-10.22.1.255)
48
-
49
-
$DNSServer = '<IP, IP addresses (comma delimitated), router>' #if not specified; defaults to fourth IP in spoke subnet scope (eg. 10.22.1.4). This would be Azure's first available IP for VM
50
-
# if <router> is specified; google IP 8.8.8.8 will be used since no DNS server exist on router
22
+
You can then use this network setup to build your environment. Here is an example:
23
+
51
24
52
-
$HyperVVMLocation = '<default>' #Leave as <default> for auto detect
53
-
$HyperVHDxLocation = '<default>' #Leave as <default> for auto detect
25
+
## Supported Environments
54
26
55
-
$VyOSIsoPath = '<default>' #Add path (eg. 'E:\ISOs\VyOS-1.1.8-amd64.iso') or use <latest> to get the latest VyOS ISO (this is still in BETA)
56
-
#If path left blank or default, it will attempt to download the supported versions (1.1.8)
27
+
- Azure Commercial
28
+
- Azure Government High
57
29
58
-
$UseBGP = $false # not required for VPN, but can help. Costs more.
- Partial knowledge with PowerShell and Azure modules
68
39
69
-
#Uses Git, SSH and SCP to build VyOS router
70
-
# 99% automated; but 90% successful
71
-
$RouterAutomationMode = $True
40
+
## Scripts
72
41
73
-
```
42
+
-**configs.ps1**. <-- This script is used to answer script values; linked to all scripts
43
+
- Make sure you edit the variables in the top section under the _General Configurations_
44
+
-_Advanced:_ Recommend you don't make changed in this section
45
+
- All scripts use this as an answer file for each setup. The answers are loaded in hashtable format and all of the required values are generated dynamically or will be prompted during execution
46
+
47
+
## Helper Functions
74
48
75
49
-**library.ps1** <-- Custom functions used for common automation
76
50
-**network.ps1** <-- Custom functions used to generating network subnets
@@ -100,33 +74,52 @@ This script does a few things:
100
74
- Setups the VyOS basic configuration (manual steps required)
101
75
- Established SSH to VyOS and attempts auto configurations for LAN network
102
76
- You will be prompted to make configurations to the router. Also once SSH is established the script will generate RSA key to auto logon.
103
-
This is a temporary process because VyOS does not save authorized_keys. if login is successful, it will auto configure the VyOS router for you otherwise you will be presented with a copy/paste configurations.
77
+
> This is a temporary process because VyOS does not save authorized_keys. if login is successful, it will auto configure the VyOS router for you otherwise you will be presented with a copy/paste configurations.
78
+
- If ssh does not work, you can manually run the scripts within the VM. Scripts are exported to log folder for each step
79
+
80
+
- Change the value to something like this:
104
81
105
-
Change the value to something like this:
106
82
```powershell
107
-
$VyOSIsoPath = 'D:\ISOs\VyOS-1.1.8-amd64.iso'
83
+
$VyOSIsoPath = 'D:\ISOs\VyOS-1.1.8-amd64.iso'
108
84
```
109
85
110
86
## Azure VPN Lab
111
87
There are few options when building the Site2Site VPN lab:
112
88
113
-
_Option A_: **Step 3A. Build Azure Basic S2S.ps1** <-- Sets up a very basic azure S2S VPN , no hub and spoke configurations.
89
+
### Option A: Simple Network
114
90
115
-
_Option B_: **Step 3B-1. Build Azure Advanced S2S - Region 1.ps1** <--Sets up a more complex Azure S2S VPN with hub and spoke design. Also run scripts:
91
+
-**Step 3A. Build Azure Basic S2S.ps1** <--Sets up a very basic azure S2S VPN , no hub and spoke configurations.
116
92
117
-
1.**Step 3B-2. Build Azure Advanced S2S - Region 2.ps1** <-- Optional if you want to setup a second site
118
-
2.**Step 3B-3. Connect Azure Advanced S2S Regions.ps1** <-- Only Required if a second site is setup
93
+
### Option B: Hub and Spoke
119
94
120
-
_Option C_: **Step 3C. Attach Azure S2S to Existing Network.ps1** <-- Connect to an existing Azure network. You must run it like this:
95
+
-**Step 3B-1. Build Azure Advanced S2S - TenantA.ps1** <--Sets up a more complex Azure S2S VPN with hub and spoke design. Also run scripts:
121
96
122
-
<spanstyle="background-color:Yellow;">**NOTE: If connected to Azure, hit tab for the virtualNetwork and Resourcegroup values to iterate through existing Azure resources. </span>
97
+
1.**Step 3B-2. Build Azure Advanced S2S - TenantB.ps1** <-- Optional if you want to setup a second site
98
+
2.**Step 3B-3. Connect Azure Advanced S2S Tenants.ps1** <-- Only Required if a second site is setup
99
+
100
+
### Option C: Existing network
101
+
102
+
-**Step 3C. Attach Azure S2S to Existing Network.ps1** <-- Connect to an existing Azure network. You must run it like this:
103
+
104
+
<spanstyle="background-color:Orange;">**NOTE: If connected to Azure, hit tab for the virtualNetwork and Resourcegroup values to iterate through existing Azure resources. </span>
<spanstyle="background-color:Red;">**IMPORTANT**: All scripts list above can be ran multiple times! If ran a second time, it will check all configurations and attempt to repair and issues. this can be useful when public IP has changed on home network</span>
128
110
129
-
If all went well, the VyOS router will connect each Azure site.
111
+
### Validate connection
112
+
113
+
If all went well, the VyOS router will connect each Azure site. You can check it two ways:
114
+
115
+
1. Run command on router:
116
+
117
+
```cmd
118
+
show vpn ipsec sa
119
+
```
120
+
121
+
2. Go to Azure Portal --> Local Network Gateways --> Click on gateway --> Connections
122
+
130
123
### Azure VM
131
124
132
125
The last thing to do is setup a VM in your Azure lab without Public IP and connect to it from you hyper-V vm. This is a good test to see if your VPN is connected
@@ -136,16 +129,16 @@ To setup a VM, run the script corresponding to the type of Azure VPN you set up
136
129
137
130
_Option 1_: **Step 4A-1. Build Azure VM.ps1**
138
131
139
-
_Option 2_: **Step 4B-1. Build Azure VM - Region 1.ps1**
132
+
_Option 2_: **Step 4B-1. Build Azure VM - TenantA.ps1**
140
133
141
134
_Option 3_ Run scripts:
142
135
143
-
1.**Step 4B-1. Build Azure VM - Region 1.ps1**
144
-
2.**Step 4B-2. Build Azure VM - Region 2.ps1**
136
+
1.**Step 4B-1. Build Azure VM - TenantA.ps1**
137
+
2.**Step 4B-2. Build Azure VM - TenantB.ps1**
145
138
146
-
_BETA_: **Step 4A-2. Build Hyper-V VM.ps1** <-- Sets up a VM in Hyper-V (not unattended)
139
+
_BETA_: **Step 4C. Build Hyper-V VM.ps1** <-- Sets up a VM in Hyper-V (not unattended)
147
140
148
-
<spanstyle="background-color:Yellow;">**IMPORTANT**: All scripts list above can be ran multiple times! If ran a second time, The script with create another VM incrementing the name automatically or you can specify an name like so:</span>
141
+
<spanstyle="background-color:Orange;">**IMPORTANT**: All scripts list above can be ran multiple times! If ran a second time, The script with create another VM incrementing the name automatically or you can specify an name like so:</span>
@@ -155,14 +148,19 @@ _BETA_: **Step 4A-2. Build Hyper-V VM.ps1** <-- Sets up a VM in Hyper-V (not una
155
148
## Known Issues
156
149
157
150
- Some devices have reduce network quality with hyper-v's external switch connecting to WiFi adapter. Recommend using physical adapter if possible
158
-
- Some ISP's (especially hotels) don't allow public IP to pulled from web crawlers such as http://ipinfo.io/json; this could be an issue with setting up Site-2-Site-VPN
151
+
- Some ISP's (especially hotels) don't allow public IP to pulled from web crawlers such as http://ipinfo.io/json; this can be an issue with when the script is setting up Site-2-Site-VPN
159
152
- Some ISP's may not allow VPN traffic; no know work around for this
160
-
- These scripts have not been tested with Azure Gov or other Azure community clouds
161
153
- After Site 2 Site VPN is created; step that check for connectivity may show _unknown) or _not connected_; this may be due to Azure's graph api call not updating immediately. Recommend manual check
162
154
- Go to Azure Portal --> Local Network Gateways --> Click on new gateway --> Connections
163
-
- VyOS router will remove it trusted ssh host list on each reboot. This is by design and will require login for each script implementation; looking for alternate method to resolve this
155
+
- VyOS router will remove it trusted ssh host list on each reboot. This is by design and will require login for each script implementation; looking for alternate method to resolve this.
164
156
- There are known issues with the PowerShell ISE interface during VyOS configurations; Recommend running with Powershell console or VScode.
165
157
158
+
## Not Supported
159
+
160
+
- These scripts have not been tested on Azure clouds other than what is stated in supported section
161
+
- Target multiple subscriptions per tenant (such as [Mission LZ](https://github.com/Azure/missionlz))
162
+
- Vnet peering between Azure and Azure Gov is NOT supported
163
+
166
164
## References
167
165
168
166
-[Create a VPN Gateway and add a Site-to-Site connection using PowerShell](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell)
@@ -175,3 +173,22 @@ _BETA_: **Step 4A-2. Build Hyper-V VM.ps1** <-- Sets up a VM in Hyper-V (not una
175
173
-[Configuring Azure Site-to-Site connectivity using VyOS Behind a NAT – Part 3](http://www.lewisroberts.com/2015/07/17/configuring-azure-site-to-site-connectivity-using-VyOS-behind-a-nat-part-3/)
176
174
-[BUILD A HYBRID CLOUD LAB INTO MICROSOFT AZURE WITH VyOS](https://bretty.me.uk/build-a-hybrid-cloud-lab-into-microsoft-azure-with-VyOS/)
0 commit comments