config.onpremises.tftpl

crypto ikev2 proposal azure-proposal
  encryption aes-cbc-256 aes-cbc-128 3des
  integrity sha1
  group 2
  exit
!
crypto ikev2 policy azure-policy
  proposal azure-proposal
  exit
!
crypto ikev2 keyring azure-keyring
  peer ${gateway_public_ip_001}
    address ${gateway_public_ip_001}
    pre-shared-key ${authorization_key}
    exit
  peer ${gateway_public_ip_002}
    address ${gateway_public_ip_002}
    pre-shared-key ${authorization_key}
    exit
  exit
!
crypto ikev2 profile azure-profile
  match address local interface GigabitEthernet1
  match identity remote address ${gateway_public_ip_001} 255.255.255.255
  match identity remote address ${gateway_public_ip_002} 255.255.255.255
  authentication remote pre-share
  authentication local pre-share
  keyring local azure-keyring
  exit
!
crypto ipsec transform-set azure-ipsec-proposal-set esp-aes 256 esp-sha-hmac
 mode tunnel
 exit

crypto ipsec profile azure-vti
  set transform-set azure-ipsec-proposal-set
  set ikev2-profile azure-profile
  set security-association lifetime kilobytes 102400000
  set security-association lifetime seconds 3600 
 exit
!
interface Tunnel0
 ip unnumbered GigabitEthernet1 
 ip tcp adjust-mss 1350
 tunnel source GigabitEthernet1
 tunnel mode ipsec ipv4
 tunnel destination ${gateway_public_ip_001}
 tunnel protection ipsec profile azure-vti
exit
!
interface Tunnel1
 ip unnumbered GigabitEthernet1 
 ip tcp adjust-mss 1350
 tunnel source GigabitEthernet1
 tunnel mode ipsec ipv4
 tunnel destination ${gateway_public_ip_002}
 tunnel protection ipsec profile azure-vti
exit

!
router bgp ${on_premises_asn}
 bgp router-id interface GigabitEthernet1
 bgp log-neighbor-changes
 neighbor ${gateway_private_ip_001} remote-as 65515
 neighbor ${gateway_private_ip_001} ebgp-multihop 5
 neighbor ${gateway_private_ip_001} update-source GigabitEthernet1
 neighbor ${gateway_private_ip_002} remote-as 65515
 neighbor ${gateway_private_ip_002} ebgp-multihop 5
 neighbor ${gateway_private_ip_002} update-source GigabitEthernet1
!
ip route ${gateway_private_ip_001} 255.255.255.255 Tunnel0
ip route ${gateway_private_ip_002} 255.255.255.255 Tunnel1
!
end
!
wr mem