The Add-VpnS2SInterface cmdlet creates a site-to-site (S2S) interface with the specified parameters to customize Internet Protocol security (IPsec) settings.
If the Protocol parameter is set to AutomaticOnly the only authentication method allowed is username.
If the authentication method is a pre-shared key, only one interface can be enabled per destination and the initiator and responder policies are governed by what is specified per interface.
If the authentication method is username or machine certificates, only initiator policies are governed by what is specified per interface, responder policies are governed by what is specified on the server.
For incoming connections:
-- If the authentication method is a pre-shared key, the interface whose destination IP matches the incoming IP is activated.
If the authentication method is username, the interface whose name matches the username is activated.
If the authentication method is certificates the interface whose name matches the certificate subject name is activated.
This command creates a site-to-site VPN interface by name EDGE1 to destination 131.107.0.20.
The protocol is IKEv2 and the authentication method is pre-shared key named ABC.
Traffic to 10.2.0.0/24 and subnet 2001:db8:2::/48 is sent over this interface if there is no other interface on the server that has same routes with metric less than 100 .
In case the interface is in disconnected state the connection is triggered if there is no other interface on the server that has same routes with metric less than 100.
Example 2: Create an interface that uses EAP authentication
This command adds an IKEv2 S2S VPN (Demand-Dial) interface to the Multi-Tenant Gateway for Routing Domain Rd_001.
Parameters
-AdminStatus
Specifies the administrator status of the cmdlet.
Parameter properties
Type:
Boolean
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-AsJob
Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-AuthenticationMethod
Specifies the AuthenticationMethod to be used by the S2S connection.
If a pre-shared key is specified as authentication method, there can only be one active site to site virtual private network (VPN) interface per destination IP address.
Parameter properties
Type:
String
Default value:
None
Accepted values:
EAP, MachineCertificates, PSKOnly, MSCHAPv2
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-AuthenticationTransformConstants
Specifies the authentication transform plumbed in IPsec policy.
Specifies the certificate to be used in default store.
Applicable only if AuthenticationMethod is set to MachineCert.
Parameter properties
Type:
X509Certificate2
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
Cert
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-CimSession
Runs the cmdlet in a remote session or on a remote computer.
Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet.
The default is the current session on the local computer.
Specifies individual traffic flows within a Generic Routing Encapsulation (GRE) tunnel.
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
GreInterface
Position:
4
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-GreTunnel
Indicates whether this cmdlet uses the GRE tunnel capability for the Windows Server Gateway.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
GreInterface
Position:
Named
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-IdleDisconnectSeconds
Specifies a value that specifies the time, in seconds, after which an idle connection is terminated.
Unless the idle time-out is disabled, the entire connection is terminated if the connection is idle for the specified interval.
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
IdleDurationSeconds, IdleDisconnectSec
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-InitiateConfigPayload
Indicates whether to initiate configuration payload negotiation.
Parameter properties
Type:
Boolean
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IntegrityCheckMethod
Specifies the integrity method plumbed in IPsec policy.
Parameter properties
Type:
IntegrityCheckMethod
Default value:
None
Accepted values:
MD5, SHA1, SHA256, SHA384
Supports wildcards:
False
DontShow:
False
Aliases:
OtherHashAlgorithm, FirstIntegrityAlgorithm
Parameter sets
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-InternalIPv4
Specifies Negotiation of IPv4 Address.
Parameter properties
Type:
Boolean
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-InternalIPv6
Specifies negotiation of IPv6 Address.
Parameter properties
Type:
Boolean
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv4Address
Indicates whether the cmdlet sets custom IKE IPsec policies.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
GreInterface
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv4Subnet
Specifies the IPv4 subnet that is routed on this connection with metric.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
IPv4TriggerSubnet
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv4TriggerFilter
Specifies a string array of IPv4 filters that trigger demand dial connections.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv4TriggerFilterAction
Indicates whether a filter should trigger an S2S connection.
Parameter properties
Type:
Action
Default value:
None
Accepted values:
Allow, Deny
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv6Address
Indicates whether the cmdlet sets custom IKE IPsec policies.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
GreInterface
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv6Subnet
Specifies the IPv6 subnet that is routed on this connection with metric.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
IPv6TriggerSubnet
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv6TriggerFilter
Specifies an array of IPv6 filters that trigger demand dial connections.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
-IPv6TriggerFilterAction
Indicates whether a filter should trigger an S2S connection.
Parameter properties
Type:
Action
Default value:
None
Accepted values:
Allow, Deny
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
True
Value from pipeline by property name:
True
Value from remaining arguments:
False
-LocalVpnTrafficSelector
Specifies the initiator Traffic Selector object.
Parameter properties
Type:
CimInstance[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-MMSALifeTimeSeconds
Specifies the lifetime of main mode security association in seconds, after which the main mode security association is no longer valid.
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
MMSaLifeTimeSec
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Name
Specifies the name of the connection.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
ElementName
Parameter sets
(All)
Position:
1
Mandatory:
True
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-NetworkOutageTimeSeconds
Specifies the maximum network outage time after which the connection is disconnected.
Acceptable values for this parameter are:
6
9
12
15
30
60
120
240
360
720
900
Parameter properties
Type:
UInt32
Default value:
None
Accepted values:
3, 6, 9, 12, 15, 30, 60, 120, 240, 360, 720, 900
Supports wildcards:
False
DontShow:
False
Aliases:
NetworkOutageTimeSec
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-NumberOfTries
Specifies the number of tries the connection is retried.
If you specify 0, the cmdlet will retry infinitely.
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-PassThru
Returns an object representing the item with which you are working.
By default, this cmdlet does not generate any output.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Password
Specifies the password of the username to be used for dialing the connection.
Applicable only if AuthenticationMethod is set to EAP.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-Persistent
Indicates whether the connection state is persisted across the service restart or system reboots.
Parameter properties
Type:
SwitchParameter
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-PfsGroup
Specifies the perfect forward secrecy (PFS) Group plumbed in IPsec policy.
Specifies the IPv4 subnet routes that are added to a site-to-site interface after the connection is established.
The values specified are not used to initiate the site-to-site VPN connection.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-PostConnectionIPv6Subnet
Specifies the IPv6 subnet routes that are added to a site-to-site interface after the connection is established.
The values specified are not used to initiate the site-to-site VPN connection.
Parameter properties
Type:
String[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-PromoteAlternate
Specifies that an alternate IP address that connects successfully becomes the primary IP address, and the current primary IP address is moved to the alternate list.
Parameter properties
Type:
Boolean
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-Protocol
Specifies the underlying protocol.
Parameter properties
Type:
String
Default value:
None
Accepted values:
L2TP, IKEv2, Automatic, SSTP
Supports wildcards:
False
DontShow:
False
Aliases:
KeyModule
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RadiusAttributeClass
Specifies a RADIUS attribute.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RemoteVpnTrafficSelector
Specifies the responder traffic selector object.
Parameter properties
Type:
CimInstance[]
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-ResponderAuthenticationMethod
Specifies the responder AuthenticationMethod to be used by the S2S connection.
Parameter properties
Type:
String
Default value:
None
Accepted values:
MachineCertificates, PSKOnly
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RetryIntervalSeconds
Number of seconds between retries.
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
RetryIntervalSec
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RoutingDomain
Specifies an ID, as a string, for a routing ___domain.
The ID of a routing ___domain is a user-defined alphanumeric string.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
RoutingDomainName
Parameter sets
(All)
Position:
3
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-RxBandwidthKbps
Specifies the receive bandwidth limit, in kilobits per second (Kbps).
Parameter properties
Type:
UInt64
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SADataSizeForRenegotiationKilobytes
Specifies the number of kilobytes that are allowed to transfer using a security association (SA).
After that the SA will be renegotiated
Parameter properties
Type:
UInt32
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
SaRenegotiationDataSizeKB, LifeTimeKiloBytes
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-SALifeTimeSeconds
Lifetime of an SA in seconds, after which the SA is no longer valid
Specifies the text of the shared secret to be used in dialing the connection.
This is only applicable if AuthenticationMethod is set to PSK.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-SourceIpAddress
Specifies the source IPv4 or IPv6 addresses to use when dialing the connection.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-ThrottleLimit
Specifies the maximum number of concurrent connections that can be established to run this command.
If you omit this parameter or enter a value of 0, the default value, 32, is used.
The throttle limit applies only to the current command, not to the session or to the computer.
Parameter properties
Type:
Int32
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
-TxBandwidthKbps
Specifies a transmit bandwidth limit, in Kbps, for the interface.
Parameter properties
Type:
UInt64
Default value:
None
Supports wildcards:
False
DontShow:
False
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-UserName
Specifies the username to be used for dialing this connection.
This is only applicable if the AuthenticationMethod parameter is set to EAP.
Parameter properties
Type:
String
Default value:
None
Supports wildcards:
False
DontShow:
False
Aliases:
User
Parameter sets
EncryptionType
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
CustomPolicy
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
True
Value from remaining arguments:
False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type:
SwitchParameter
Default value:
False
Supports wildcards:
False
DontShow:
False
Aliases:
wi
Parameter sets
(All)
Position:
Named
Mandatory:
False
Value from pipeline:
False
Value from pipeline by property name:
False
Value from remaining arguments:
False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters.