Menu

Lumen help

Creating an IP VPN On‑Demand connection to Azure

With Lumen® IP VPN On‑Demand, you can use NaaS Manager to create a connection from a Lumen VRF to Microsoft Azure. To create the connection, you'll need an ExpressRoute service key from Microsoft (which you receive when you create an ExpressRoute circuit using the Azure portal). Be sure to have that information handy to type in (or copy/paste). 

There are three steps to successfully create and use your IP VPN On‑Demand connection to Azure:

1. Create the ExpressRoute circuit
2. Create the connection in NaaS Manager
3. Finish provisioning the ExpressRoute circuit

Note: You can only use a service key that isn't assigned to an active connection. 

Step 1: Create the ExpressRoute circuit

To create an ExpressRoute circuit in the Azure portal: 

  1. Go to the Azure portal and sign in.
  1. On the Azure portal menu, click + Create a resource. 
  1. Search for ExpressRoute, then click Create.
  1. Select a Resource group. If you don't have a resource group, click Create new, type a name, then click OK.  
  1. Select a Region. NaaS Manager uses the region you to list the available on ramps when you create the On-Demand connection. 
  1. Type a Name. 
  1. Click Next. 
  1. Fill in the Configuration.

    1. Select Provider for Port type. 

    2. Click Provider, then select CenturyLink Cloud Provider from the list.

    3. Select a Peering location. NaaS Manager uses the location you select here to list the available on ramps when you create the On-Demand connection. 

    4. Select a Bandwidth. This is the maximum bandwidth you can use for the On-Demand connection.  

    5. Leave SKU, Billing model, and Allow classic operations at the default settings. 
  1. Click Next.
  1. Add tags to categorize resources if needed, then click Next. 
  1. Review the ExpressRoute, then click Create. 
  1. Go to All resources and select the ExpressRoute circuit you created.  
  1. On Overview, click the copy icon next to the Service key. You will paste this when creating the On-Demand connection. 

Once you create the ExpressRoute circuit, the Azure portal shows Not provisioned in the Provider status field and Enabled in the Circuit status field. Learn more about ExpressRoute circuit status 

Step 2: Create the connection in NaaS Manager

To create the connection in NaaS Manager:

  1. Click Services.

    Control Center shows the Services console. Use the console to access an inventory of your services, check the status of orders, and manage your services.
Services console
  1. In the Service Managers box, click Network-as-a-Service (NaaS).
     

The NaaS Manager Overview lists connection options. 

NaaS Manager Overview tab
  1. Click Create Connection for IP VPN On-Demand.
  1. From the Customer ID and Billing Account Number lists, select the customer number and billing account number you want to add IP VPN On-Demand to.

    NaaS Manager fills in the VRF inventory based on the customer ID and billing account number you selected. 
  1. In the Connection Name field, type a name for the connection you're creating. (Be sure to use something memorable. This name will appear on your invoice.) 
  1. In the From Location (Select Your VRF) section, select a VRF for the other end of your connection.

    Click View Details for a VRF to view the VRF's routes. 

    If no VRFs are available for the customer number and billing account number you selected, click Create New, then type a description for the new VRF in the New VRF Description field. NaaS Manager will create the VRF when you create the connection.
NaaS Manager Services tab
  1. From the Cloud Provider list, select Azure. 
  1. In the ExpressRoute Service Key field, type or copy and paste your ExpressRoute service key provided by Microsoft. (Note: You can only us a service key that isn't assigned to an active connection.)

    Once you fill in the ExpressRoute service key, NaaS Manager retrieves connection information from Microsoft and fills in the on ramp information. 
  1. Click CONTINUE. 
  1. Use the Billing Method buttons to select whether you want monthly or hourly billing for the connection, then select the bandwidth for the connection. Bandwidth options are determined by the destination (to location). (You can't change the bandwidth once you create the connection. If you need to choose a different bandwidth after creating the connection, disconnect the connection and create a new one.)
IP VPN On-Demand bandwidth and price
  1. Click CONTINUE.
  1. In the Select Additional Settings section, fill in the additional details for the connection. (NaaS Manager automatically makes the connection private and sets 12076 as the AS number for Azure.)

    1. In the Routing Option field, select the radio button for the routing option you want to use for the connection. Learn more about routing options for an IP VPN connection 

    2. Use the buttons to select whether you want to advertise default routes and whether this is a primary or backup connection. 
NaaS Manager Services tab
  1. Click CONTINUE. 
  1. Review the order information and correct any missing or invalid selections, then click SUBMIT ORDER.

    NaaS Manager creates the request for connection, places it in Pending Activation status, and routes you to the Services tab so you can monitor the status of the connection. To see status updates, click . Once Lumen assigns the permanent VRF (within five minutes), the connection changes to Active status. 

Step 3: Finish provisioning the ExpressRoute circuit with Azure

To finish provisioning the ExpressRoute circuit: 

  1. Once the connection is in Active status, view the details for the information you need to take back to the Azure portal to finish setting up the connection and creating the Azure private peering. 
  1. Complete the provisioning of your ExpressRoute circuit:

    1. Go to the Azure portal and sign in.

    2. Select the ExpressRoute you created. 

    3. In the Peer ASN field, type 3549.

    4. In the Subnets field, select the IPv4 radio button.

    5. In the IPv4 Primary subnet field, type (or copy/paste) the information in the Primary Router Peer IP field in your connection details.

    6. In the IPv4 Secondary subnet field, type (or copy/paste) the information in the Secondary Router Peer IP field. 

    7. Leave the Enable IPv6 Peering checkbox, IPv6 Primary subnet field, and IPv6 Secondary subnet field empty. (Lumen doesn't use IPv6 for connections.)

    8. In the VLAN ID field, type (or copy/paste) the information in the VLAN ID field in your connection details.

    9. If you want to use an MD5 hash, type (or copy/paste) the information in the BGP Auth Key field in your connection details into the Shared key field.
  1. Click Save.

    The Azure portal provisions the ExpressRoute circuit and shows Provisioned in the Provider Status field.