text: ---
  subcategory: "Network"
  layout: "azurerm"
  page_title: "Azure Resource Manager: azurerm_virtual_network_gateway_connection"
  description: |-
    Manages a connection in an existing Virtual Network Gateway.
  ---
  
  # azurerm_virtual_network_gateway_connection
  
  Manages a connection in an existing Virtual Network Gateway.
  
  ## Example Usage
  
  ### Site-to-Site connection
  
  The following example shows a connection between an Azure virtual network
  and an on-premises VPN device and network.
  
  ```hcl
  resource "azurerm_resource_group" "example" {
    name     = "test"
    location = "West US"
  }
  
  resource "azurerm_virtual_network" "example" {
    name                = "test"
    location            = azurerm_resource_group.example.location
    resource_group_name = azurerm_resource_group.example.name
    address_space       = ["10.0.0.0/16"]
  }
  
  resource "azurerm_subnet" "example" {
    name                 = "GatewaySubnet"
    resource_group_name  = azurerm_resource_group.example.name
    virtual_network_name = azurerm_virtual_network.example.name
    address_prefix       = "10.0.1.0/24"
  }
  
  resource "azurerm_local_network_gateway" "onpremise" {
    name                = "onpremise"
    location            = azurerm_resource_group.example.location
    resource_group_name = azurerm_resource_group.example.name
    gateway_address     = "168.62.225.23"
    address_space       = ["10.1.1.0/24"]
  }
  
  resource "azurerm_public_ip" "example" {
    name                = "test"
    location            = azurerm_resource_group.example.location
    resource_group_name = azurerm_resource_group.example.name
    allocation_method   = "Dynamic"
  }
  
  resource "azurerm_virtual_network_gateway" "example" {
    name                = "test"
    location            = azurerm_resource_group.example.location
    resource_group_name = azurerm_resource_group.example.name
  
    type     = "Vpn"
    vpn_type = "RouteBased"
  
    active_active = false
    enable_bgp    = false
    sku           = "Basic"
  
    ip_configuration {
      public_ip_address_id          = azurerm_public_ip.example.id
      private_ip_address_allocation = "Dynamic"
      subnet_id                     = azurerm_subnet.example.id
    }
  }
  
  resource "azurerm_virtual_network_gateway_connection" "onpremise" {
    name                = "onpremise"
    location            = azurerm_resource_group.example.location
    resource_group_name = azurerm_resource_group.example.name
  
    type                       = "IPsec"
    virtual_network_gateway_id = azurerm_virtual_network_gateway.example.id
    local_network_gateway_id   = azurerm_local_network_gateway.onpremise.id
  
    shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
  }
  ```
  
  ### VNet-to-VNet connection
  
  The following example shows a connection between two Azure virtual network
  in different locations/regions.
  
  ```hcl
  resource "azurerm_resource_group" "us" {
    name     = "us"
    location = "East US"
  }
  
  resource "azurerm_virtual_network" "us" {
    name                = "us"
    location            = azurerm_resource_group.us.location
    resource_group_name = azurerm_resource_group.us.name
    address_space       = ["10.0.0.0/16"]
  }
  
  resource "azurerm_subnet" "us_gateway" {
    name                 = "GatewaySubnet"
    resource_group_name  = azurerm_resource_group.us.name
    virtual_network_name = azurerm_virtual_network.us.name
    address_prefix       = "10.0.1.0/24"
  }
  
  resource "azurerm_public_ip" "us" {
    name                = "us"
    location            = azurerm_resource_group.us.location
    resource_group_name = azurerm_resource_group.us.name
    allocation_method   = "Dynamic"
  }
  
  resource "azurerm_virtual_network_gateway" "us" {
    name                = "us-gateway"
    location            = azurerm_resource_group.us.location
    resource_group_name = azurerm_resource_group.us.name
  
    type     = "Vpn"
    vpn_type = "RouteBased"
    sku      = "Basic"
  
    ip_configuration {
      public_ip_address_id          = azurerm_public_ip.us.id
      private_ip_address_allocation = "Dynamic"
      subnet_id                     = azurerm_subnet.us_gateway.id
    }
  }
  
  resource "azurerm_resource_group" "europe" {
    name     = "europe"
    location = "West Europe"
  }
  
  resource "azurerm_virtual_network" "europe" {
    name                = "europe"
    location            = azurerm_resource_group.europe.location
    resource_group_name = azurerm_resource_group.europe.name
    address_space       = ["10.1.0.0/16"]
  }
  
  resource "azurerm_subnet" "europe_gateway" {
    name                 = "GatewaySubnet"
    resource_group_name  = azurerm_resource_group.europe.name
    virtual_network_name = azurerm_virtual_network.europe.name
    address_prefix       = "10.1.1.0/24"
  }
  
  resource "azurerm_public_ip" "europe" {
    name                = "europe"
    location            = azurerm_resource_group.europe.location
    resource_group_name = azurerm_resource_group.europe.name
    allocation_method   = "Dynamic"
  }
  
  resource "azurerm_virtual_network_gateway" "europe" {
    name                = "europe-gateway"
    location            = azurerm_resource_group.europe.location
    resource_group_name = azurerm_resource_group.europe.name
  
    type     = "Vpn"
    vpn_type = "RouteBased"
    sku      = "Basic"
  
    ip_configuration {
      public_ip_address_id          = azurerm_public_ip.europe.id
      private_ip_address_allocation = "Dynamic"
      subnet_id                     = azurerm_subnet.europe_gateway.id
    }
  }
  
  resource "azurerm_virtual_network_gateway_connection" "us_to_europe" {
    name                = "us-to-europe"
    location            = azurerm_resource_group.us.location
    resource_group_name = azurerm_resource_group.us.name
  
    type                            = "Vnet2Vnet"
    virtual_network_gateway_id      = azurerm_virtual_network_gateway.us.id
    peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.europe.id
  
    shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
  }
  
  resource "azurerm_virtual_network_gateway_connection" "europe_to_us" {
    name                = "europe-to-us"
    location            = azurerm_resource_group.europe.location
    resource_group_name = azurerm_resource_group.europe.name
  
    type                            = "Vnet2Vnet"
    virtual_network_gateway_id      = azurerm_virtual_network_gateway.europe.id
    peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.us.id
  
    shared_key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y"
  }
  ```
  
  ## Argument Reference
  
  The following arguments are supported:
  
  * `name` - (Required) The name of the connection. Changing the name forces a
      new resource to be created.
  
  * `resource_group_name` - (Required) The name of the resource group in which to
      create the connection Changing the name forces a new resource to be created.
  
  * `location` - (Required) The location/region where the connection is
      located. Changing this forces a new resource to be created.
  
  * `type` - (Required) The type of connection. Valid options are `IPsec`
      (Site-to-Site), `ExpressRoute` (ExpressRoute), and `Vnet2Vnet` (VNet-to-VNet).
      Each connection type requires different mandatory arguments (refer to the
      examples above). Changing the connection type will force a new connection
      to be created.
  
  * `virtual_network_gateway_id` - (Required) The ID of the Virtual Network Gateway
      in which the connection will be created. Changing the gateway forces a new
      resource to be created.
  
  * `authorization_key` - (Optional) The authorization key associated with the
      Express Route Circuit. This field is required only if the type is an
      ExpressRoute connection.
  
  * `express_route_circuit_id` - (Optional) The ID of the Express Route Circuit
      when creating an ExpressRoute connection (i.e. when `type` is `ExpressRoute`).
      The Express Route Circuit can be in the same or in a different subscription.
  
  * `peer_virtual_network_gateway_id` - (Optional) The ID of the peer virtual
      network gateway when creating a VNet-to-VNet connection (i.e. when `type`
      is `Vnet2Vnet`). The peer Virtual Network Gateway can be in the same or
      in a different subscription.
  
  * `local_network_gateway_id` - (Optional) The ID of the local network gateway
      when creating Site-to-Site connection (i.e. when `type` is `IPsec`).
  
  * `routing_weight` - (Optional) The routing weight. Defaults to `10`.
  
  * `shared_key` - (Optional) The shared IPSec key. A key could be provided if a
      Site-to-Site, VNet-to-VNet or ExpressRoute connection is created.
  
  * `connection_protocol` - (Optional) The IKE protocol version to use. Possible
      values are `IKEv1` and `IKEv2`. Defaults to `IKEv2`.
      Changing this value will force a resource to be created.
  -> **Note**: Only valid for `IPSec` connections on virtual network gateways with SKU `VpnGw1`, `VpnGw2`, `VpnGw3`, `VpnGw1AZ`, `VpnGw2AZ` or `VpnGw3AZ`.
  
  * `enable_bgp` - (Optional) If `true`, BGP (Border Gateway Protocol) is enabled
      for this connection. Defaults to `false`.
  
  * `express_route_gateway_bypass` - (Optional) If `true`, data packets will bypass ExpressRoute Gateway for data forwarding This is only valid for ExpressRoute connections.
  
  * `use_policy_based_traffic_selectors` - (Optional) If `true`, policy-based traffic
      selectors are enabled for this connection. Enabling policy-based traffic
      selectors requires an `ipsec_policy` block. Defaults to `false`.
  
  * `ipsec_policy` (Optional) A `ipsec_policy` block which is documented below.
      Only a single policy can be defined for a connection. For details on
      custom policies refer to [the relevant section in the Azure documentation](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell).
  
  * `traffic_selector_policy` A `traffic_selector_policy` which allows to specify traffic selector policy proposal to be used in a virtual network gateway connection.
      Only one block can be defined for a connection.
      For details about traffic selectors refer to [the relevant section in the Azure documentation](https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps).
  
  * `tags` - (Optional) A mapping of tags to assign to the resource.
  
  The `ipsec_policy` block supports:
  
  * `dh_group` - (Required) The DH group used in IKE phase 1 for initial SA. Valid
      options are `DHGroup1`, `DHGroup14`, `DHGroup2`, `DHGroup2048`, `DHGroup24`,
      `ECP256`, `ECP384`, or `None`.
  
  * `ike_encryption` - (Required) The IKE encryption algorithm. Valid
      options are `AES128`, `AES192`, `AES256`, `DES`, or `DES3`.
  
  * `ike_integrity` - (Required) The IKE integrity algorithm. Valid
      options are `MD5`, `SHA1`, `SHA256`, or `SHA384`.
  
  * `ipsec_encryption` - (Required) The IPSec encryption algorithm. Valid
      options are `AES128`, `AES192`, `AES256`, `DES`, `DES3`, `GCMAES128`, `GCMAES192`, `GCMAES256`, or `None`.
  
  * `ipsec_integrity` - (Required) The IPSec integrity algorithm. Valid
      options are `GCMAES128`, `GCMAES192`, `GCMAES256`, `MD5`, `SHA1`, or `SHA256`.
  
  * `pfs_group` - (Required) The DH group used in IKE phase 2 for new child SA.
      Valid options are `ECP256`, `ECP384`, `PFS1`, `PFS2`, `PFS2048`, `PFS24`,
      or `None`.
  
  * `sa_datasize` - (Optional) The IPSec SA payload size in KB. Must be at least
      `1024` KB. Defaults to `102400000` KB.
  
  * `sa_lifetime` - (Optional) The IPSec SA lifetime in seconds. Must be at least
      `300` seconds. Defaults to `27000` seconds.
  
  ## Attributes Reference
  
  The following attributes are exported:
  
  * `id` - The ID of the Virtual Network Gateway Connection.
  
  ## Timeouts
  
  The `timeouts` block allows you to specify [timeouts](https://www.terraform.io/docs/configuration/resources.html#timeouts) for certain actions:
  
  * `create` - (Defaults to 30 minutes) Used when creating the Virtual Network Gateway Connection.
  * `update` - (Defaults to 30 minutes) Used when updating the Virtual Network Gateway Connection.
  * `read` - (Defaults to 5 minutes) Used when retrieving the Virtual Network Gateway Connection.
  * `delete` - (Defaults to 30 minutes) Used when deleting the Virtual Network Gateway Connection.
  
  ## Import
  
  Virtual Network Gateway Connections can be imported using their `resource id`, e.g.
  
  ```
  terraform import azurerm_virtual_network_gateway_connection.exampleConnection /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myGroup1/providers/Microsoft.Network/connections/myConnection1
  ```
  