Policy-based traffic selectors

In the Ultra Transcenders books

AZ-700

Each book explains Policy-based traffic selectors in context, with comparison tables and the common traps.

Terms in this definition

• Route-based VPN

  Type of VPN gateway that relies on routing tables and any-to-any traffic selectors. Point-to-site, BGP and gateway transit all need it, and it is the only type you can create in the portal.

• DEFINE

  An optional keyword at the start of a DAX query, placed before the first EVALUATE, for declaring things such as measures and variables that exist only for that query. A measure declared this way replaces a model measure with the same name just while the query runs.

• Custom IPsec/IKE policy

  Set of algorithms for IKE Phase 1 and IPsec Phase 2, together with DH and PFS groups and SA lifetimes, applied to one connection rather than the gateway; each connection takes one policy, and every parameter has to be filled in.

• IKEv2

  Open-standard IPsec key exchange protocol for site-to-site tunnels, also offered as a point-to-site tunnel type that authenticates with certificates or RADIUS. Authentication through Microsoft Entra ID is not possible with it.

Related terms

• New-AzVirtualNetworkGatewayConnection

  Cmdlet in Az.Network for creating site-to-site (IPsec), VNet-to-VNet or ExpressRoute connections. Its parameters include -SharedKey, -IpsecPolicies, -UsePolicyBasedTrafficSelectors and -EnableBgp.

• Policy-based VPN

  Rather than routing any-to-any, this kind of VPN matches fixed prefix pairs as static traffic selectors. Because BGP, point-to-site and transit are unsupported, route-based gateways connect to such devices by enabling policy-based traffic selectors.

• Set-AzVirtualNetworkGatewayConnection

  Cmdlet in Az.Network for modifying a gateway connection that already exists, for instance to apply -IpsecPolicies or turn on policy-based traffic selectors.