Virtual WAN documentation

Learn how to configure, create, and manage an Azure Virtual WAN. Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface.

• Virtual WAN documentation
• Overview
  • What is Virtual WAN?
• Quickstarts
  • ARM templates
    • Any-to-any routing
    • Route to shared services VNets
  • BICEP templates
    • Deploy Virtual WAN with routing intent and routing policies
• Tutorials
  • Create a site-to-site connection
  • Create User VPN point-to-site connections
  • Create an ExpressRoute connection
• Concepts
  • What's new?
  • Work remotely
    • Support for working remotely
    • Leverage Virtual WAN
  • Virtual WAN FAQ
  • Virtual Hub third-party integrations
    • Overview of third-party integrations
    • Integrated NVAs in the Virtual Hub
    • Software-as-a-serviceSaaS
    • Branch IPSEC connectivity automation
      • About branch IPSEC connectivity automation
      • Automation guidelines for partners
  • Architecture
    • Migrate to Virtual WAN
    • Global transit network architecture
    • SD-WAN connectivity architecture
    • Private Link and DNS architecture for Virtual WAN
    • Configure Virtual WAN for Azure NetApp Files
    • Interconnect with China
  • Routing
    • About virtual hub routing
    • About Route-maps
    • Virtual WAN routing deep dive
  • Scenarios
    • Virtual hub routing preference
    • Any-to-any
    • Isolating VNets
    • Isolating VNets - custom
    • Isolating virtual networks and branches
    • Shared services VNets
    • Route through an NVA
    • Route through an NVA - custom
    • BGP peering with virtual hub
    • Azure Firewall - custom
    • Application Gateway and backend pools
    • Microsoft 365 - ExpressRoute private peering
  • Site-to-site
    • About S2S IPsec policies
    • Multiple ISP links - Azure path selection
  • Point-to-site
    • P2S concepts
    • P2S IPsec policies
    • P2S client address pools
    • P2S global and hub profiles
    • User groups - assign client-specific addresses
  • ExpressRoute
    • About ExpressRoute in Virtual WAN
  • Virtual hub settings
  • Roles and permissions
  • Gateway settings
  • Apply Zero Trust principles
  • Secured virtual hubs
  • Security baseline
  • Pricing explained
• How-to guides
  • Upgrade from Basic to Standard
  • Integrated NVA in a virtual hub
    • Create a NVA in a virtual hub
    • Restart a NVA in a virtual hub
    • Configure DNAT/Internet inbound
  • Connect a VNet to a virtual hub
    • Azure portal
    • Azure PowerShell
  • Create a cross-tenant VNet connection
    • Azure PowerShell
    • Azure CLI
  • ExpressRoute
    • Create an ExpressRoute association
      • Azure portal
      • Azure PowerShell
    • Configure ExpressRoute encryption
  • Site-to-site
    • Create a site-to-site connection
      • Azure portal
      • Azure PowerShell
    • Connect virtual network gateway to Virtual WAN
    • Configure custom IPsec policy
    • Configure NAT rules
      • Azure portal
      • Azure PowerShell
  • User VPN point-to-site
    • P2S server configuration
      • Certificate or RADIUS authentication
        • Configure a P2S VPN
          • Azure portal
          • PowerShell
        • Generate self-signed certificates
      • Microsoft Entra ID authentication
        • Configure a P2S VPN
        • Configure a tenant
        • Configure multifactor authentication MFA
    • P2S client configuration
      • Microsoft Entra authentication clients
        • Windows clients
        • macOS clients
        • Multi-application Microsoft Entra authentication
      • Certificate authentication clients
        • Windows clients
        • macOS and iOS clients
        • Install client certificates
      • VPN client profiles
        • Download global and hub profiles
        • Extract and view profile information
        • Intune- Deploy VPN client profile
      • Azure VPN client optional settings
      • OpenVPN client software configuration
    • Configure Always On tunnels
      • User tunnel
      • Device tunnel
    • Configure forced tunneling
    • Configure user groups for address pools
      • Configure a user group
      • RADIUS - configure NPS vendor-specific attributes
  • Routing
    • Configure virtual hub routing
      • Azure portal
      • Azure PowerShell
    • Configure virtual hub routing preference
      • Azure portal
      • Azure PowerShell
    • View virtual hub effective routes
    • Configure Route-maps
    • How to configure routing intent and policies
    • Route traffic from a virtual hub to an NVA legacy
      • Azure portal
      • Azure PowerShell
    • Configure BGP peering to an NVA
      • Azure portal
      • Azure PowerShell
  • Security
    • Install Azure Firewall in a hub
    • Inter-hub and branch-to-branch inspection
    • Software-as-a-service SaaS
    • Configure Private Link connectivity
    • Manage access to resources - Spoke VNet P2S
  • Monitoring
    • Monitor Virtual WAN
    • Azure Monitor Insights
    • BGP dashboard
    • Route-maps dashboard
    • Configure S2S VPN packet captures
      • Azure portal
      • PowerShell
    • Advanced Monitoring for P2S VPN
  • Configure customer-controlled gateway maintenance
• Reference
  • Azure PowerShell
  • REST
  • Azure CLI
  • Python SDK
  • Monitoring data reference
• Resources
  • Pricing
  • Subscription and service limits
  • Networking Roadmap
  • Networking blog
  • Networking update announcements
  • Pricing calculator
  • SLA