UsePolicyBasedTrafficSelectors** ($True/$False Optional, default $False if not specified) ( Optional: default values are used if not specified) The following table lists the supported configurable cryptographic algorithms and key strengths. S2S or VNet-to-VNet connections can't establish if the policies are incompatible.

Consult with your VPN device vendor specifications to ensure the policy is supported on your on-premises VPN devices.

Partial policy specification isn't allowed.

You must specify all algorithms and parameters for both IKE (Main Mode) and IPsec (Quick Mode).

You can only specify one policy combination for a given connection.

IPsec/IKE policy only works on the following gateway SKUs:.

Be aware of the following considerations: Refer to About cryptographic requirements and Azure VPN gateways to see how this can help ensure cross-premises and VNet-to-VNet connectivity to satisfy your compliance or security requirements. IPsec and IKE protocol standard supports a wide range of cryptographic algorithms in various combinations.

Configure/update/remove the IPsec/IKE policy on the connection resources.

Create a connection (IPsec or VNet2VNet).

Create a local network gateway for cross premises connection, or another virtual network and gateway for VNet-to-VNet connection.

Create a virtual network and a VPN gateway.

The instructions in this article help you set up and configure IPsec/IKE policies as shown in the following diagram.

The following sections help you create and configure an IPsec/IKE policy, and apply the policy to a new or existing connection. This article walks you through the steps to configure IPsec/IKE policy for VPN Gateway Site-to-Site VPN or VNet-to-VNet connections using the Azure portal.

Checkpoint policy based vpn