VPN Site-to-Site — Azure + On-Premises RRAS

RG_CLOUD="rg-lab08-cloud"
az group create --name $RG_CLOUD --location southeastasia

# VNet + subnets
az network vnet create \
  --resource-group $RG_CLOUD --name cloud-vnet \
  --address-prefix 10.10.0.0/16 \
  --subnet-name subnet-cloud \
  --subnet-prefix 10.10.0.0/24 \
  --location southeastasia

az network vnet subnet create \
  --resource-group $RG_CLOUD --vnet-name cloud-vnet \
  --name GatewaySubnet --address-prefix 10.10.255.0/27

# Cloud VM (no Public IP)
az vm create \
  --resource-group $RG_CLOUD --name cloud-vm \
  --image Win2022Datacenter --size Standard_B2s \
  --vnet-name cloud-vnet --subnet subnet-cloud \
  --public-ip-address "" \
  --admin-username AdminCloud \
  --admin-password "P@ssw0rd2026!Lab"

# Public IP Zone-redundant cho VPN Gateway
az network public-ip create \
  --resource-group $RG_CLOUD --name pip-vpn-gw-lab08 \
  --sku Standard --allocation-method Static \
  --zone 1 2 3 --location southeastasia

# Tạo VPN Gateway VpnGw2AZ (--no-wait để không bị timeout)
az network vnet-gateway create \
  --resource-group $RG_CLOUD --name vpn-gw-lab08 \
  --vnet cloud-vnet --gateway-type Vpn \
  --vpn-type RouteBased --sku VpnGw2AZ \
  --generation Generation2 \
  --public-ip-addresses pip-vpn-gw-lab08 \
  --location southeastasia --no-wait

echo "VPN Gateway đang tạo — tiếp tục Bước 2 trong lúc chờ"

RG_ONPREM="rg-lab08-onprem"
az group create --name $RG_ONPREM --location eastasia

# VNet on-prem simulation
az network vnet create \
  --resource-group $RG_ONPREM --name onprem-vnet \
  --address-prefix 192.168.1.0/24 \
  --subnet-name subnet-onprem \
  --subnet-prefix 192.168.1.0/25 \
  --location eastasia

# Public IP Standard cho RRAS VM
az network public-ip create \
  --resource-group $RG_ONPREM --name pip-rras \
  --sku Standard --allocation-method Static \
  --location eastasia

# NSG cho RRAS: allow IKE và NAT-T
az network nsg create \
  --resource-group $RG_ONPREM --name nsg-rras

az network nsg rule create \
  --resource-group $RG_ONPREM --nsg-name nsg-rras \
  --name Allow-IKE --priority 100 \
  --protocol Udp --destination-port-ranges 500 \
  --access Allow --direction Inbound

az network nsg rule create \
  --resource-group $RG_ONPREM --nsg-name nsg-rras \
  --name Allow-NATT --priority 110 \
  --protocol Udp --destination-port-ranges 4500 \
  --access Allow --direction Inbound

az network nsg rule create \
  --resource-group $RG_ONPREM --nsg-name nsg-rras \
  --name Allow-RDP --priority 120 \
  --protocol Tcp --destination-port-ranges 3389 \
  --access Allow --direction Inbound

# NIC với IP forwarding enabled
az network nic create \
  --resource-group $RG_ONPREM --name nic-rras \
  --vnet-name onprem-vnet --subnet subnet-onprem \
  --public-ip-address pip-rras \
  --network-security-group nsg-rras \
  --ip-forwarding true

# Tạo RRAS VM
az vm create \
  --resource-group $RG_ONPREM --name onprem-rras-vm \
  --nics nic-rras \
  --image Win2022Datacenter --size Standard_B2s \
  --admin-username AdminOnPrem \
  --admin-password "P@ssw0rd2026!Lab"

# Lấy Public IP của pip-rras
RRAS_PIP=$(az network public-ip show \
  -g $RG_ONPREM -n pip-rras \
  --query ipAddress -o tsv)
echo "RRAS Public IP: $RRAS_PIP"

RG_CLOUD="rg-lab08-cloud"

# Lấy Public IP của RRAS (chạy lệnh này hoặc dùng giá trị đã ghi)
RRAS_PIP=$(az network public-ip show \
  -g rg-lab08-onprem -n pip-rras \
  --query ipAddress -o tsv)

# Tạo Local Network Gateway (đại diện cho on-prem trong Azure)
az network local-gateway create \
  --resource-group $RG_CLOUD \
  --name lng-onprem \
  --gateway-ip-address $RRAS_PIP \
  --local-address-prefixes 192.168.1.0/24 \
  --location southeastasia

# Tạo VPN Connection S2S với IKEv2
az network vpn-connection create \
  --resource-group $RG_CLOUD \
  --name conn-azure-to-onprem \
  --vnet-gateway1 vpn-gw-lab08 \
  --local-gateway2 lng-onprem \
  --connection-type IPsec \
  --shared-key "AzureLabPSK2026!" \
  --connection-protocol IKEv2 \
  --location southeastasia

# Kiểm tra trạng thái connection (sẽ Unknown cho đến khi RRAS cấu hình xong)
az network vpn-connection show \
  --resource-group $RG_CLOUD \
  --name conn-azure-to-onprem \
  --query "connectionStatus" -o tsv

RG_CLOUD="rg-lab08-cloud"

# Kiểm tra trạng thái VPN Connection
az network vpn-connection show \
  --resource-group $RG_CLOUD \
  --name conn-azure-to-onprem \
  --query "{status:connectionStatus,ingress:ingressBytesTransferred,egress:egressBytesTransferred}" \
  --output json

# Xem thống kê traffic
az network vpn-connection list \
  --resource-group $RG_CLOUD \
  --output table

# Connection Troubleshoot từ cloud-vm tới RRAS VM private IP
az network watcher test-connectivity \
  --resource-group $RG_CLOUD \
  --source-resource cloud-vm \
  --dest-address 192.168.1.4 \
  --dest-port 3389