Cisco
Login
Search
Software Secure Access
Activity Manage

Cisco Secure Access Help Network Tunnel Configuration Configure a Site-to-Site VPN tunnel with Microsoft Azure Configure S2S Tunnels with Static Routing Step 2: Create a network tunnel group in Secure Access

Last updated: Aug 07, 2025

Step 2: Create a network tunnel group in Secure Access

Create a network tunnel group in Secure Access with the following configuration. For a more detailed procedure, see Add a Network Tunnel Group.

  1. Step 1 - General Settings: Set Device Type to AZURE.
  2. Step 2 - Tunnel ID and Passphrase: Enter the primary and secondary public IPs from the Azure virtual network gateway and create a passphrase.
  3. Step 3 - Routing
    1. Option 1, Enable NAT / Outbound only: Enable NAT / Outbound only if you determine that the IP address space behind the tunnel group overlaps with other IP address spaces in your network.

       
      Enabling NAT for outbound traffic disables the routing options described below. Private applications hosted behind these tunnels will not be accessible.
    2. Option 2, Static routing: Add all public and private IPv4 address ranges used internally for your Azure virtual network. This example uses the range 10.255.0.0/16.
  4. Step 4 - Data for Tunnel Setup: Copy or download the primary and secondary tunnel IDs, data center (DC) IP addresses, and the passphrase you created.

     
    This is the only time your passphrase will be displayed.
Previous topic Step 1: Create a VPN Gateway in Microsoft Azure Next topic Step 3: Create two local network gateways in Azure with S2S connections