Add-VpnS2SInterface

Syntax

Add-VpnS2SInterface
   [-Name] <String>
   [-Protocol <String>]
   [-Destination] <String[]>
   [-AdminStatus <Boolean>]
   [-PromoteAlternate <Boolean>]
   [-AuthenticationMethod <String>]
   [-PostConnectionIPv4Subnet <String[]>]
   [-PostConnectionIPv6Subnet <String[]>]
   [-InitiateConfigPayload <Boolean>]
   [-RadiusAttributeClass <String>]
   [-EnableQoS <EnableQoS>]
   [-TxBandwidthKbps <UInt64>]
   [-RxBandwidthKbps <UInt64>]
   [-IPv4TriggerFilter <String[]>]
   [-IPv6TriggerFilter <String[]>]
   [-Persistent]
   [-IPv4TriggerFilterAction <Action>]
   [-IPv6TriggerFilterAction <Action>]
   [-SADataSizeForRenegotiationKilobytes <UInt32>]
   [-IPv4Subnet <String[]>]
   [-IPv6Subnet <String[]>]
   [-ResponderAuthenticationMethod <String>]
   [-PassThru]
   [[-RoutingDomain] <String>]
   [-Certificate <X509Certificate2>]
   [-SharedSecret <String>]
   [-NetworkOutageTimeSeconds <UInt32>]
   [-NumberOfTries <UInt32>]
   [-RetryIntervalSeconds <UInt32>]
   [-SALifeTimeSeconds <UInt32>]
   [-EapMethod <String>]
   [-InternalIPv4 <Boolean>]
   [-InternalIPv6 <Boolean>]
   [-IdleDisconnectSeconds <UInt32>]
   [-UserName <String>]
   [-Password <String>]
   [-SourceIpAddress <String>]
   [-EncryptionType <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Add-VpnS2SInterface
   [-Name] <String>
   [-Protocol <String>]
   [-Destination] <String[]>
   [-AdminStatus <Boolean>]
   [-PromoteAlternate <Boolean>]
   [-AuthenticationMethod <String>]
   [-PostConnectionIPv4Subnet <String[]>]
   [-PostConnectionIPv6Subnet <String[]>]
   [-InitiateConfigPayload <Boolean>]
   [-RadiusAttributeClass <String>]
   [-EnableQoS <EnableQoS>]
   [-TxBandwidthKbps <UInt64>]
   [-RxBandwidthKbps <UInt64>]
   [-IPv4TriggerFilter <String[]>]
   [-IPv6TriggerFilter <String[]>]
   [-Persistent]
   [-IPv4TriggerFilterAction <Action>]
   [-IPv6TriggerFilterAction <Action>]
   [-SADataSizeForRenegotiationKilobytes <UInt32>]
   [-IPv4Subnet <String[]>]
   [-IPv6Subnet <String[]>]
   [-ResponderAuthenticationMethod <String>]
   [-PassThru]
   [[-RoutingDomain] <String>]
   [-Certificate <X509Certificate2>]
   [-SharedSecret <String>]
   [-NetworkOutageTimeSeconds <UInt32>]
   [-NumberOfTries <UInt32>]
   [-RetryIntervalSeconds <UInt32>]
   [-SALifeTimeSeconds <UInt32>]
   [-EapMethod <String>]
   [-InternalIPv4 <Boolean>]
   [-InternalIPv6 <Boolean>]
   [-IdleDisconnectSeconds <UInt32>]
   [-UserName <String>]
   [-Password <String>]
   [-CustomPolicy]
   [-EncryptionMethod <EncryptionMethod>]
   [-IntegrityCheckMethod <IntegrityCheckMethod>]
   [-CipherTransformConstants <CipherTransformConstants>]
   [-AuthenticationTransformConstants <AuthenticationTransformConstants>]
   [-PfsGroup <PfsGroup>]
   [-DHGroup <DHGroup>]
   [-SourceIpAddress <String>]
   [-CimSession <CimSession[]>]
   [-ThrottleLimit <Int32>]
   [-AsJob]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The Add-VpnS2SInterface cmdlet creates a site-to-site (S2S) interface with the specified parameters. Use the CustomPolicy parameter to customize IPsec settings. If the Protocol parameter is set to Automatic, then the only authentication method allowed is user name. If the AuthenticationMethod parameter is set to pre-shared key (PSK), then only one interface can be enabled per destination and the initiator and responder policies are governed by what is specified per interface. If the AuthenticationMethod parameter is set to user name or computer certificates (MachineCert), then only initiator policies are governed by what is specified per interface and responder policies are governed by what is specified on the server.

For incoming connections:

-- If the AuthenticationMethod parameter is set to PSK, the interface for which the destination IP matches the incoming IP is activated.

-- If the AuthenticationMethod parameter is set to user name, then the name of the interface that matches the user name is activated.

-- If the AuthenticationMethod parameter is set to certificates, then the name of the interface that matches the certificate subject name is activated.

Examples

EXAMPLE 1

PS C:\> Add-VpnS2SInterface -Nameedge1 -Destination 131.107.0.20 -Protocol IKEv2 -AuthenticationMethod PSKOnly -SharedSecret abc -IPv4Subnet 10.2.0.0/24:100 -IPv6Subnet 2001:db8:2::/48:100

This example creates a S2S VPN interface named edge1 to the destination server 131.107.0.20. The protocol is IKEv2 and the authentication method is PSK. The string abc is used as PSK. Traffic to 10.2.0.0/24 and 2001:db8:2::/48 is sent over this interface if there is no other interface on the server that has same routes with a metric less than 100 . In case the interface is in disconnected state the connection is triggered if there is no other interface on the server that has same routes with a metric less than 100.

EXAMPLE 2

PS C:\>Add-VpnS2SInterface -IPv4Subnet @("131.0.1.0/24:254", "121.0.0.0/16:124") -UserName "abc@contoso.com" -Destination "30.0.0.1" -IPv6Subnet @("3ffe::/32:24", "2ffe::/32:24") -AuthenticationMethod "EAP" -Name "TestVpnS2SInterface" -RetryInterval 120 -EncryptionType "RequireEncryption" -InternalIPv4 1 -InternalIPv6 1 -NumberofTries 20 -AdminStatus $true -IdleDisconnectSeconds 300 -PromoteAlternate $true -Password "1111_aaaa" -PassThru
Name                 Destination          AdminStatus  ConnectionState IPv4Subnet 
----                 -----------          -----------  --------------- ---------- 
TestVpnS2SInterface  {30.0.0.1}           True         Disconnected    {131.0.1.0/24:254, 121.0.0.0/16:124}

This example creates an interface that uses EAP authentication method and multiple subnets are routed on this interface including 131.0.1.0/24 and 121.0.0.0/16.

EXAMPLE 3

PS C:\>Add-VpnS2SInterface -CustomPolicy -UserName "abc@contoso.com" -EncryptionMethod "AES128" -Destination "30.0.0.1" -Password "1111_aaaa" -DhGroup "Group2" -PfsGroup "PFS2" -CipherTransformConstants "AES128" -Name "TestVpnS2SInterface" -IntegrityCheckMethod "SHA256" -AuthenticationTransformConstants "SHA256128" -Protocol "IKEv2"

This example creates a S2S VPN interface using custom encryption settings.

EXAMPLE 4

PS C:\>$cert1 = Get-ChildItem -Path cert:LocalMachine\My | Where-Object -FilterScript { $_.Subject -Like "*CN=edge1.contoso.com*" }



PS C:\>Add-VpnS2SInterface -Name e1 -Destination 1.1.1.1 -AuthenticationMethod MachineCertificates -Certificate $cert1 -ResponderAuthenticationMethod MachineCertificates -Protocol IKEv2

This example creates a S2S interface with authentication method of computer certificate and specifies the certificate for which the subject name is edge1.contoso.com.

Parameters

-AdminStatus

-AsJob

-AuthenticationMethod

-AuthenticationTransformConstants

-Certificate

-CimSession

-CipherTransformConstants

-Confirm

-CustomPolicy

-Destination

-DHGroup

-EapMethod

-EnableQoS

-EncryptionMethod

-EncryptionType

-IdleDisconnectSeconds

-InitiateConfigPayload

-IntegrityCheckMethod

-InternalIPv4

-InternalIPv6

-IPv4Subnet

-IPv4TriggerFilter

-IPv4TriggerFilterAction

-IPv6Subnet

-IPv6TriggerFilter

-IPv6TriggerFilterAction

-Name

-NetworkOutageTimeSeconds

-NumberOfTries

-PassThru

-Password

-Persistent

-PfsGroup

-PostConnectionIPv4Subnet

-PostConnectionIPv6Subnet

-PromoteAlternate

-Protocol

-RadiusAttributeClass

-ResponderAuthenticationMethod

-RetryIntervalSeconds

-RoutingDomain

-RxBandwidthKbps

-SADataSizeForRenegotiationKilobytes

-SALifeTimeSeconds

-SharedSecret

-SourceIpAddress

-ThrottleLimit

-TxBandwidthKbps

-UserName

-WhatIf

Inputs

None

Outputs

CimInstance

The Microsoft.Management.Infrastructure.CimInstance object is a wrapper class that displays Windows Management Instrumentation (WMI) objects. The path after the pound sign (#) provides the namespace and class name for the underlying WMI object.

Related Links

• Add-VpnS2SInterface
• Clear-VpnS2SInterfaceStatistics
• Connect-VpnS2SInterface
• Disconnect-VpnS2SInterface
• Get-VpnAuthProtocol
• Get-VpnS2SInterface
• Get-VpnS2SInterfaceStatistics
• Remove-VpnS2SInterface
• Set-VpnAuthProtocol
• Set-VpnS2SInterface