azure-vwan-vpn-connection-record
An active S2S VPN connection (vpnConnections, connectionStatus=Connected) is an explicit routing fact: the Virtual Hub routes traffic to and from the on-premises branch via the VPN tunnel.
where
properties.connectionStatus == 'Connected'
emit
| source type | TransitGateway |
|---|---|
| target type | VPN |
| source | <Virtual Hub that owns the parent vpnGateway> |
| target | <VPN Site node resolved from properties.remoteVpnSite.id> |
| state logic | ACTIVE when connectionStatus == Connected (IKEv2 SA is UP). CONDITIONAL(network_reachability) when connectionStatus is Connecting or Unknown (tunnel negotiating; may not carry traffic yet). NOT emitted for connectionStatus == NotConnected or Failed. |
Narrative
Hub {hub.name} has an active S2S VPN tunnel to branch {vpnSite.name} (connectionStatus: Connected).
Raw rule rules/explicit/azure/vwan.yaml
id: azure-vwan-vpn-connection-record
emits: RoutesTo
description: 'An active S2S VPN connection (vpnConnections, connectionStatus=Connected) is an explicit
routing fact: the Virtual Hub routes traffic to and from the on-premises branch via the VPN tunnel.'
applies_to:
- azure
source_config:
resource_type: Microsoft.Network/vpnGateways/vpnConnections
field: properties
where:
- properties.connectionStatus == 'Connected'
emit:
source_type: TransitGateway
target_type: VPN
source: <Virtual Hub that owns the parent vpnGateway>
target: <VPN Site node resolved from properties.remoteVpnSite.id>
api_source: Microsoft.Network/vpnGateways/vpnConnections GET
evidence_field: properties.connectionStatus + properties.remoteVpnSite.id
state_logic: ACTIVE when connectionStatus == Connected (IKEv2 SA is UP). CONDITIONAL(network_reachability)
when connectionStatus is Connecting or Unknown (tunnel negotiating; may not carry traffic yet). NOT
emitted for connectionStatus == NotConnected or Failed.
narrative: 'Hub {hub.name} has an active S2S VPN tunnel to branch {vpnSite.name} (connectionStatus:
Connected).'
derived_from: []