Configure an Azure Dedicated Cloud Gateway with virtual WAN

TL;DR

In Azure, you’ll need a virtual network, virtual WAN and hub. Create a Dedicated Cloud Gateway in Konnect with Azure as the network provider. When the Azure network is Ready in Konnect, you can configure virtual hub peering by creating the peering role and assigning it to the service principal. You can use your Azure Dedicated Cloud Gateway after it displays as Ready for virtual hub peering.

Prerequisites

This tutorial requires a Konnect Plus account. If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

To approve the Dedicated Cloud Gateway app, you need a Microsoft Entra admin account with the Application Administrator role.

Copy your Entra tenant ID from your dashboard.

Install the Azure CLI and authenticate:

az login

To configure virtual hub peering in Konnect, you’ll need:

Copy your virtual WAN subscription ID and resource group name, and the name of the virtual hub associated with your virtual WAN.

Important: Your Azure virtual network must use a different IP than your network in Konnect, which is 10.0.0.0/16 by default but can be edited. The Azure virtual network and virtual WAN must also use CIDRs that don’t overlap.

Create an Azure Dedicated Cloud Gateway

First, configure a Dedicated Cloud Gateway with an Azure network.

  1. In the Konnect sidebar, click API Gateway.
  2. From the New dropdown menu, select “New API gateway”.
  3. Select Dedicated Cloud.
  4. In the Gateway name field, enter Azure.
  5. Click Create and configure.
  6. From the Provider dropdown menu, select “Azure”.
  7. From the Region dropdown menu, select the region you want to configure the cluster in.
  8. Edit the Network range as needed.

    Important: Your Azure virtual network must use a different IP than your network in Konnect, which is 10.0.0.0/16 by default but can be edited.

  9. From the Access dropdown menu, select “Public” or “Private”.
  10. Click Create data plane node.

Important: Wait until your Azure network displays as Ready before proceeding to the next step.

Configure Azure virtual hub peering in Konnect

Now that your Dedicated Cloud Gateway Azure network is ready, you can configure virtual hub peering to connect your Azure virtual WAN to your Dedicated Cloud Gateway.

  1. In the Konnect sidebar, click API Gateway.
  2. Click your Azure Dedicated Cloud Gateway.
  3. Click the Networks tab.
  4. From the action menu next to your Azure network, select “Configure private networking”.
  5. Click Virtual hub peering.
  6. In the Tenant ID field, enter your Microsoft Entra tenant ID.
  7. In the Subscription ID field, enter your virtual WAN’s subscription ID.
  8. In the Resource group name field, enter your virtual WAN’s resource group name.
  9. In the Virtual hub name field, enter your virtual WAN’s hub name.
  10. Click Next.
  11. Grant access to the Dedicated Cloud Gateway app in Microsoft Entra using the link provided in the setup wizard.

    Important: You need an admin account to approve the app.

  12. Create a peering role with the Azure CLI using the command in the UI wizard.

    Konnect requires permission to create and manage peering resources. You must define a role named Kong Cloud Gateway Peering Creator with the following permissions:

    • Read and write access to virtual hub configurations
    • Permission to perform peering actions
  13. Assign the role to the service principal so it has permission to peer with your virtual hub using the command in the UI wizard.
  14. Select I’ve completed the Azure setup steps above.
  15. Click Done.

Validate

After your virtual hub peering configuration displays as ready, you can begin using your Dedicated Cloud Gateway. To verify that it’s ready, do the following:

  1. In the Konnect sidebar, click API Gateway.
  2. Click your Azure Dedicated Cloud Gateway.
  3. Click the Networks tab.
  4. Scroll until you see Ready for virtual hub peering.

FAQs

Because configuring virtual hub peering requires approving the Konnect app in Microsoft Entra (a step that generates a link only available in the Konnect UI), you must complete the initial setup using the UI before managing the resource in Terraform.

After the peering is Ready, you can manage it with Terraform by importing the existing konnect_cloud_gateway_transit_gateway into your Terraform state. For a complete example, see cloud-gateways.tf. The following example shows what the resource block looks like:

resource "konnect_cloud_gateway_transit_gateway" "my_vhub_peering" {
  network_id = var.network_id

  azure_vhub_peering_gateway = {
    name = "azure virtual hub peering"

    transit_gateway_attachment_config = {
      kind                = "azure-vhub-peering-attachment"
      tenant_id           = var.tenant_id
      subscription_id     = var.subscription_id
      resource_group_name = var.resource_group_name
      vhub_name           = var.vhub_name
    }
  }
}

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!