Add-VpnS2SInterface

Syntax

Add-VpnS2SInterface
   [-Name] <String>
   [-Protocol <String>]
   [-Destination] <String[]>
   [-AdminStatus <Boolean>]
   [-PromoteAlternate <Boolean>]
   [-AuthenticationMethod <String>]
   [-PostConnectionIPv4Subnet <String[]>]
   [-PostConnectionIPv6Subnet <String[]>]
   [-InitiateConfigPayload <Boolean>]
   [-RadiusAttributeClass <String>]
   [-EnableQoS <EnableQoS>]
   [-TxBandwidthKbps <UInt64>]
   [-RxBandwidthKbps <UInt64>]
   [-IPv4TriggerFilter <String[]>]
   [-IPv6TriggerFilter <String[]>]
   [-Persistent]
   [-AutoConnectEnabled <Boolean>]
   [-IPv4TriggerFilterAction <Action>]
   [-IPv6TriggerFilterAction <Action>]
   [-SADataSizeForRenegotiationKilobytes <UInt32>]
   [-IPv4Subnet <String[]>]
   [-IPv6Subnet <String[]>]
   [-ResponderAuthenticationMethod <String>]
   [-PassThru]
   [[-RoutingDomain] <String>]
   [-Certificate <X509Certificate2>]
   [-SharedSecret <String>]
   [-NetworkOutageTimeSeconds <UInt32>]
   [-NumberOfTries <UInt32>]
   [-RetryIntervalSeconds <UInt32>]
   [-SALifeTimeSeconds <UInt32>]
   [-MMSALifeTimeSeconds <UInt32>]
   [-EapMethod <String>]
   [-InternalIPv4 <Boolean>]
   [-InternalIPv6 <Boolean>]
   [-IdleDisconnectSeconds <UInt32>]
   [-UserName <String>]
   [-Password <String>]
   [-SourceIpAddress <String>]
   [-LocalVpnTrafficSelector <CimInstance[]>]
   [-RemoteVpnTrafficSelector <CimInstance[]>]
   [-EncryptionType <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Add-VpnS2SInterface
   [-Name] <String>
   [-Destination] <String[]>
   [-AdminStatus <Boolean>]
   [-EnableQoS <EnableQoS>]
   [-TxBandwidthKbps <UInt64>]
   [-RxBandwidthKbps <UInt64>]
   [-IPv4Subnet <String[]>]
   [-IPv6Subnet <String[]>]
   [-PassThru]
   [[-RoutingDomain] <String>]
   [-InternalIPv4 <Boolean>]
   [-InternalIPv6 <Boolean>]
   -SourceIpAddress <String>
   [[-GreKey] <UInt32>]
   [-GreTunnel]
   [-IPv4Address <String>]
   [-IPv6Address <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Add-VpnS2SInterface
   [-Name] <String>
   [-Protocol <String>]
   [-Destination] <String[]>
   [-AdminStatus <Boolean>]
   [-PromoteAlternate <Boolean>]
   [-AuthenticationMethod <String>]
   [-PostConnectionIPv4Subnet <String[]>]
   [-PostConnectionIPv6Subnet <String[]>]
   [-InitiateConfigPayload <Boolean>]
   [-RadiusAttributeClass <String>]
   [-EnableQoS <EnableQoS>]
   [-TxBandwidthKbps <UInt64>]
   [-RxBandwidthKbps <UInt64>]
   [-IPv4TriggerFilter <String[]>]
   [-IPv6TriggerFilter <String[]>]
   [-Persistent]
   [-AutoConnectEnabled <Boolean>]
   [-IPv4TriggerFilterAction <Action>]
   [-IPv6TriggerFilterAction <Action>]
   [-SADataSizeForRenegotiationKilobytes <UInt32>]
   [-IPv4Subnet <String[]>]
   [-IPv6Subnet <String[]>]
   [-ResponderAuthenticationMethod <String>]
   [-PassThru]
   [[-RoutingDomain] <String>]
   [-Certificate <X509Certificate2>]
   [-SharedSecret <String>]
   [-NetworkOutageTimeSeconds <UInt32>]
   [-NumberOfTries <UInt32>]
   [-RetryIntervalSeconds <UInt32>]
   [-SALifeTimeSeconds <UInt32>]
   [-MMSALifeTimeSeconds <UInt32>]
   [-EapMethod <String>]
   [-InternalIPv4 <Boolean>]
   [-InternalIPv6 <Boolean>]
   [-IdleDisconnectSeconds <UInt32>]
   [-UserName <String>]
   [-Password <String>]
   [-CustomPolicy]
   [-EncryptionMethod <EncryptionMethod>]
   [-IntegrityCheckMethod <IntegrityCheckMethod>]
   [-CipherTransformConstants <CipherTransformConstants>]
   [-AuthenticationTransformConstants <AuthenticationTransformConstants>]
   [-PfsGroup <PfsGroup>]
   [-DHGroup <DHGroup>]
   [-SourceIpAddress <String>]
   [-LocalVpnTrafficSelector <CimInstance[]>]
   [-RemoteVpnTrafficSelector <CimInstance[]>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The Add-VpnS2SInterface cmdlet creates a site-to-site (S2S) interface with the specified parameters to customize Internet Protocol security (IPsec) settings. If the Protocol parameter is set to AutomaticOnly the only authentication method allowed is username. If the authentication method is a pre-shared key, only one interface can be enabled per destination and the initiator and responder policies are governed by what is specified per interface. If the authentication method is username or machine certificates, only initiator policies are governed by what is specified per interface, responder policies are governed by what is specified on the server. For incoming connections:

-- If the authentication method is a pre-shared key, the interface whose destination IP matches the incoming IP is activated.

• If the authentication method is username, the interface whose name matches the username is activated.
• If the authentication method is certificates the interface whose name matches the certificate subject name is activated.

Examples

Example 1: Create a S2S VPN interface

PS C:\>Add-VpnS2SInterface -Name "EDGE1" 131.107.0.20 -Protocol IKEv2 -AuthenticationMethod PSKOnly -SharedSecret "ABC" -IPv4Subnet 10.2.0.0/24:100 -IPv6Subnet 2001:db8:2::/48:100

This command creates a site-to-site VPN interface by name EDGE1 to destination 131.107.0.20. The protocol is IKEv2 and the authentication method is pre-shared key named ABC. Traffic to 10.2.0.0/24 and subnet 2001:db8:2::/48 is sent over this interface if there is no other interface on the server that has same routes with metric less than 100 . In case the interface is in disconnected state the connection is triggered if there is no other interface on the server that has same routes with metric less than 100.

Example 2: Create an interface that uses EAP authentication

PS C:\>Add-VpnS2SInterface -IPv4Subnet @("131.0.1.0/24:254", "121.0.0.0/16:124") -UserName "abc@contoso.com" -Destination "30.0.0.1" -IPv6Subnet @("3ffe::/32:24", "2ffe::/32:24") -AuthenticationMethod "EAP" -Name "TestVpnS2SInterface" -RetryInterval 120 -EncryptionType "RequireEncryption" -InternalIPv4 1 -InternalIPv6 1 -NumberofTries 20 -AdminStatus $True -IdleDisconnectSeconds 300 -PromoteAlternate $True -Password "1111_aaaa" -PassThru
Name                 Destination          AdminStatus  ConnectionState IPv4Subnet
----                 -----------          -----------  --------------- ----------
TestVpnS2SInterface  {30.0.0.1}           True         Disconnected    {131.0.1.0/24:254, 121.0.0.0/16:124}

This command creates an interface that uses EAP authentication method and multiple subnets are routed on this interface 131.0.1.0/24, 121.0.0.0/16.

Example 3: Add an IKEv2 S2S VPN interface

PS C:\>Add-VpnS2SInterface -RoutingDomain Rd_001 -Name "Blue-Tunnel-2" -Protocol IKEv2 -Destination 100.0.0.7 -AuthenticationMethod PSKOnly -SharedSecret 111_aaa -Persistent -IPv4Subnet 172.23.90.4/32:100 -PassThru
RoutingDomain   Name                 Destination          AdminStatus  ConnectionState IPv4Subnet
-------------   ----                 -----------          -----------  --------------- ----------
Rd_001          Blue-Tunnel-2        {100.0.0.7}          True         Disconnected    {172.23.90.4/32:100}

This command adds an IKEv2 S2S VPN (Demand-Dial) interface to the Multi-Tenant Gateway for Routing Domain Rd_001

Example 4: Add a Gre Tunnel interface

PS C:\>Add-VpnS2SInterface -GreTunnel -GreKey "1234" -RoutingDomain Rd_001 -Name "Blue-Tunnel-3" -Destination 100.0.0.8 -Persistent -IPv4Subnet 172.23.90.4/32:100 -PassThru
RoutingDomain   Name                 Destination          AdminStatus  ConnectionState IPv4Subnet
-------------   ----                 -----------          -----------  --------------- ----------
Rd_001          Blue-Tunnel-3        {100.0.0.8}          True         Connected    {172.23.90.4/32:100}

This command adds a Gre Tunnel interface to the Multi-Tenant Gateway for Routing Domain named Rd_001.

Example 5: Add an IKEv2 S2S VPN interface with Traffic Selectors

PS C:\>Add-VpnS2SInterface -RoutingDomain Rd_001 -Name "Blue-Tunnel-2" -Protocol IKEv2 -Destination 100.0.0.7 -AuthenticationMethod PSKOnly -SharedSecret 111_aaa -Persistent -IPv4Subnet 172.23.90.4/32:100 -LocalVpnTrafficSelector $localTSObject -RemoteVpnTrafficSelector $RemoteTSObject -PassThru | fl *
IPv4TriggerFilterAction          : 
IPv6TriggerFilterAction          : 
Certificate                      : 
EnableQoS                        : Enabled
AdminStatus                      : True
AuthenticationMethod             : PSKOnly
ConnectionState                  : Connected
Destination                      : {100.0.0.7}
EapMethod                        : 
IdleDisconnect                   : 500
InitiateConfigPayload            : True
InterfaceType                    : FullRouter
InternalIPv4                     : True
InternalIPv6                     : True
IPv4Subnet                       : {172.23.90.4/32:100}
IPv4TriggerFilter                : 
IPv6Subnet                       : 
IPv6TriggerFilter                : 
LastError                        : 0
LocalVpnTrafficSelector          : {VpnTrafficSelector}
MMSALifeTime                     : 28800
Name                             : Blue-Tunnel-2_9e8ddf33-cadc-48bd-861b-150311c53c9a
NetworkOutageTime                : 15
NumberOfTries                    : 3
Persistent                       : False
PostConnectionIPv4Subnet         : 
PostConnectionIPv6Subnet         : 
PromoteAlternate                 : False
Protocol                         : Ikev2
RemoteVpnTrafficSelector         : {VpnTrafficSelector}
ResponderAuthenticationMethod    : PSKOnly
RetryInterval                    : 60
RxBandwidthKbps                  : 0
SADataSizeForRenegotiation       : 33553408
SALifeTime                       : 3600
SourceIpAddress                  : 
TxBandwidthKbps                  : 0
UnReachabilityReasons            : 
UserName                         : 
RoutingDomain                    : Rd_001_fa3a844e-c397-4004-9c48-547ce397fe59
PSComputerName                   :

This command adds an IKEv2 S2S VPN (Demand-Dial) interface to the Multi-Tenant Gateway for Routing Domain Rd_001.

Required Parameters

Optional Parameters

Outputs

Microsoft.Management.Infrastructure.CimInstance#VpnS2SInterface

Related Links

• Connect-VpnS2SInterface
• Disconnect-VpnS2SInterface
• Get-VpnS2SInterface
• Remove-VpnS2SInterface
• Set-VpnS2SInterface
• Remote Access Cmdlets