{"id":840,"date":"2025-05-16T07:39:27","date_gmt":"2025-05-16T07:39:27","guid":{"rendered":"https:\/\/www.sdwan2.com\/?p=840"},"modified":"2025-05-19T00:58:50","modified_gmt":"2025-05-19T00:58:50","slug":"deploy-velocloud-virtual-edge-in-azure-the-manual-way","status":"publish","type":"post","link":"https:\/\/www.sdwan2.com\/index.php\/2025\/05\/16\/deploy-velocloud-virtual-edge-in-azure-the-manual-way\/","title":{"rendered":"Deploy Velocloud virtual Edge in Azure (the manual way)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">About VCE in Azure &#8211; the background<\/h2>\n\n\n\n<p>To deploy a virtual Velocloud Edge (VCE) at Azure, typically, you will use the &#8220;Template specs&#8221; in Azure, which you upload a JSON file as template (There is one of the template by Velocloud: <a href=\"https:\/\/community.broadcom.com\/communities\/community-home\/librarydocuments\/viewdocument?DocumentKey=04598214-527e-46b1-9fa9-4e30bdba4da0\">https:\/\/community.broadcom.com\/communities\/community-home\/librarydocuments\/viewdocument?DocumentKey=04598214-527e-46b1-9fa9-4e30bdba4da0<\/a>). In the backend, the template will utilize the VCE image in the Azure Marketplace. However, in China, the Azure is operated by 21Vianet which the marketplace is &#8220;isolated&#8221;. Thus, there is no Velocloud image in Azure China marketplace and hence the template does not work. In this scenario, a manual deployment of VCE is required. It is also possible someone want to learn exactly how things work so they do not want to use the template.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2-ARM or 3-ARM?<\/h3>\n\n\n\n<p>When use the &#8220;Template specs&#8221;, the VCE comes with two NICs, that is a 2-ARM deployment. However, when manually deploy the VCE, you might heard the VM must be 3-ARM which the first NIC is a management interface. Let&#8217;s clear this confusion here. The virtual VCE image, when it first booted and detected it is in a public cloud environment (at least this is true for Azure), it will automatically change the first interface as management interface, which does not participate in the data plane. Then, the question is, how can the template let the virtual VCE only use two interfaces? The answer is during the cloud-init stage, it is possible to disable this management interface, the template&#8217;s cloud-init included this. In this article, I will show the cloud-init setting which can disable the management interface.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Serial console on Azure Virtual Machine<\/h3>\n\n\n\n<p>As of today (May-2025), Azure provide serial console to virtual machine in most regions, the details can be found here: <a href=\"https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/azure\/virtual-machines\/windows\/serial-console-overview\">https:\/\/learn.microsoft.com\/en-us\/troubleshoot\/azure\/virtual-machines\/windows\/serial-console-overview<\/a><\/p>\n\n\n\n<p>It is convenient and helpful for troubleshooting in the console of the virtual VCE is usable. However, in order to use the console, a password must be set, which means the authentication cannot be key-based only. In this article, a password is set to demonstrate the possibility of using the console port. If your security requirement does not allow a static password, you need to adjust the configuration accordingly.<\/p>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Procedure of how to manually deploy the VCE in Azure<\/h2>\n\n\n\n<p>Let&#8217;s see the steps to deploy the VCE in Azure manually.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Create Storage account and container<\/h2>\n\n\n\n<p>If there is already existing storage account and container in your VNET, you can skip this step. To create the storage account, in the Azure portal, go to &#8220;Storage accounts&#8221; and select &#8220;Create a storage account&#8221;, in this example, a storage account called &#8220;accountea2&#8221; is created:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1311\" height=\"1040\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/create-storage-account.jpg\" alt=\"\" class=\"wp-image-846\"\/><figcaption class=\"wp-element-caption\">Figure 1 &#8211; create a storage account called &#8220;accountea2&#8221;<\/figcaption><\/figure>\n\n\n\n<p>After the storage account is created, go to the corresponding &#8220;Storage Browser&#8221;, and select &#8220;Blob containers&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2523\" height=\"1044\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/storage-browser-container.jpg\" alt=\"\" class=\"wp-image-847\"\/><figcaption class=\"wp-element-caption\">Figure 2 &#8211; Blob containers at Storage browser<\/figcaption><\/figure>\n\n\n\n<p>Add a container, the container is the location to store the VCE image. In this article, a container called &#8220;images&#8221; is created:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2548\" height=\"986\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/add-container-images.jpg\" alt=\"\" class=\"wp-image-849\"\/><figcaption class=\"wp-element-caption\">Figure 3 &#8211; Add container called images<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2535\" height=\"987\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/image.png\" alt=\"\" class=\"wp-image-850\"\/><figcaption class=\"wp-element-caption\">Figure 4 &#8211; a container call images created<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Upload and Create VCE images<\/h2>\n\n\n\n<p>Click on the Blob container called &#8220;images&#8221;. Upload the file &#8220;edge-VC_XEN_AWS-x86_64-5.0.1.5-66-R5015-20230929-GA-112911-c3310b7f05-updatable-ext4.vhd&#8221; to the images container:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2556\" height=\"984\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/upload-image-to-blob-1.jpg\" alt=\"\" class=\"wp-image-851\"\/><figcaption class=\"wp-element-caption\">Figure 5 &#8211; upload the VCE vhd to the blob container<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2556\" height=\"987\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/upload-in-progress.jpg\" alt=\"\" class=\"wp-image-852\"\/><figcaption class=\"wp-element-caption\">Figure 6 &#8211; upload vhd in progress<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2544\" height=\"988\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/image-upload-complete.jpg\" alt=\"\" class=\"wp-image-855\"\/><figcaption class=\"wp-element-caption\">Figure 7 &#8211; when vhd image upload completed<\/figcaption><\/figure>\n\n\n\n<p>The reason for selecting this &#8220;edge-VC_XEN_AWS-x86_64-5.0.1.5-66-R5015-20230929-GA-112911-c3310b7f05-updatable-ext4.vhd&#8221; is this is the current version in market place as of May-2025. If you don&#8217;t have this file, ask your Velocloud SE. And this is the md5sum:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>d09b9158af749bb7a08841c08d6675e2  .\/edge-VC_XEN_AWS-x86_64-5.0.1.5-66-R5015-20230929-GA-112911-c3310b7f05-updatable-ext4.vhd<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Create the VCE image<\/h2>\n\n\n\n<p>Go to &#8220;Images&#8221; in Azure portal, select &#8220;Custom Images&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2554\" height=\"985\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/custom-image-1.jpg\" alt=\"\" class=\"wp-image-856\"\/><figcaption class=\"wp-element-caption\">Figure 8 &#8211; Location to create the custom image<\/figcaption><\/figure>\n\n\n\n<p>Click Create, name the image as &#8220;Velocloud-5015-Image&#8221;, select OS as Linux with &#8220;Gen 1&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1216\" height=\"977\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/create-image-screen1.jpg\" alt=\"\" class=\"wp-image-857\"\/><figcaption class=\"wp-element-caption\">Figure 9 &#8211; Create image Velocloud-5015-Image, Linux Gen 1<\/figcaption><\/figure>\n\n\n\n<p>In the Storage blob field, select the &#8220;edge-VC_XEN_AWS-x86_64-5.0.1.5-66-R5015-20230929-GA-112911-c3310b7f05-updatable-ext4.vhd&#8221; uploaded in the previous step.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2509\" height=\"961\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/select-blob.jpg\" alt=\"\" class=\"wp-image-858\"\/><figcaption class=\"wp-element-caption\">Figure 10 &#8211; select &#8220;edge-VC_XEN_AWS-x86_64-5.0.1.5-66-R5015-20230929-GA-112911-c3310b7f05-updatable-ext4.vhd&#8221;<\/figcaption><\/figure>\n\n\n\n<p>In the Account type, Standard SSD is select in this article. For Host caching, select &#8220;Read\/write&#8221;. The following screen capture shows the remaining parameters for VCE image creation:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1355\" height=\"984\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/create-image-remaining.jpg\" alt=\"\" class=\"wp-image-859\"\/><figcaption class=\"wp-element-caption\">Figure 11 &#8211; remaining parameters for create image Velocloud-5015-Image<\/figcaption><\/figure>\n\n\n\n<p>After click &#8220;Review + create&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1037\" height=\"963\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/after-review-and-create.jpg\" alt=\"\" class=\"wp-image-860\"\/><figcaption class=\"wp-element-caption\">Figure 11 &#8211; Validation passed for image creation<\/figcaption><\/figure>\n\n\n\n<p> and then click &#8220;Create&#8221;. An image called &#8220;Velocloud-5015-Image&#8221; is created:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2553\" height=\"981\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/created-Velocloud-5015-Image.jpg\" alt=\"\" class=\"wp-image-861\"\/><figcaption class=\"wp-element-caption\">Figure 12 &#8211; Velocloud-5015-Image created successfully<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Network Diagram of the VCE in Azure<\/h2>\n\n\n\n<p>A network diagram will be helpful for understanding how the VCE deployment looks like.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1575\" height=\"317\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/network-diagram.jpg\" alt=\"\" class=\"wp-image-951\"\/><figcaption class=\"wp-element-caption\">Figure 13 &#8211; Network Diagram<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Network Security Groups<\/h2>\n\n\n\n<p>On both WAN side (GE1) and LAN side (GE2), a network security group is required. The purpose of this article is not about how the security groups should be configured. Sample security groups are being show here, administrator should adjust them to fit their own requirements.<\/p>\n\n\n\n<p>The following is the sample WAN side Network Security Group with name &#8220;VELO_vVCE_SG&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2530\" height=\"990\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/inbound-VELO-vVCE-SG.jpg\" alt=\"\" class=\"wp-image-864\"\/><figcaption class=\"wp-element-caption\">Figure 14 &#8211; inbound and outbound rules for VELO_vVCE_SG security group<\/figcaption><\/figure>\n\n\n\n<p>The following is the sample LAN side Network Security Group with name &#8220;VELO_vVCE_LAN_SG&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2540\" height=\"978\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/inbound-and-outbound-VELO_vVCE_LAN_SG.jpg\" alt=\"\" class=\"wp-image-866\"\/><figcaption class=\"wp-element-caption\">Figure 15 &#8211; inbound and outbound rules for VELO_vVCE_LAN_SG security group<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Create Network Interface(s)<\/h2>\n\n\n\n<p>For the virtual VCE in Azure, GE1 will be WAN (overlay enabled) and GE2 will be LAN (overlay disabled). In the Azure side, that means the first interface is WAN (subnet can access Internet), and the second interface is LAN (the interface accept traffic from other client\/server located in the VNET)<\/p>\n\n\n\n<p>Since the manual deployment is not using a template, the VM initially will only have a single NIC and the setting of that NIC is not what we need. As a result, here will manually create the two NICs and they will be associated to the VM (the virtual VCE) later.<\/p>\n\n\n\n<p>Firstly, let&#8217;s create the GE1 (WAN). Go to Network Interface, give it a name &#8220;Demo-Azure01-GE1&#8221;, select the Region and Subnet match your environment. For the IP address assignment, since this is WAN side, dynamic is fine.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1100\" height=\"973\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-WAN-Interface1.jpg\" alt=\"\" class=\"wp-image-870\"\/><figcaption class=\"wp-element-caption\">Figure 15 &#8211; Review + create WAN (GE1) interface<\/figcaption><\/figure>\n\n\n\n<p>After click &#8220;Review + create&#8221; and with Validation passed, click &#8220;Create&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"937\" height=\"967\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-WAN-Interface2-validate.jpg\" alt=\"\" class=\"wp-image-871\"\/><figcaption class=\"wp-element-caption\">Figure 16 &#8211; Create WAN (GE1) interface<\/figcaption><\/figure>\n\n\n\n<p>Secondly, create the GE2 (LAN). Give the interface name &#8220;Demo-Azure01-GE2&#8221;, for the private IPv4 address, it is recommended to use a static IP because this will be the default gateway of the route table which accept the traffic to go through SD-WAN. In this article, the NIC &#8220;Demo-Azure01-GE2&#8221; will be using 172.30.1.13 as the IP address. Let&#8217;s see the screen capture:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1163\" height=\"990\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-LAN-Interface1.jpg\" alt=\"\" class=\"wp-image-873\"\/><figcaption class=\"wp-element-caption\">Figure 17 &#8211; &#8220;Review + create&#8221; of the LAN (GE2) interface<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1012\" height=\"979\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/image-1.png\" alt=\"\" class=\"wp-image-874\"\/><figcaption class=\"wp-element-caption\">Figure 18 &#8211; Create LAN (GE2) interface<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Assign the Network Security Group to the NIC<\/h2>\n\n\n\n<p>Assign the corresponding Network Security Group to the NIC. For Demo-Azure01-GE1 (WAN side), assign &#8220;VELO_vVCE_SG&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1478\" height=\"983\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/GE1-Security-Group11.jpg\" alt=\"\" class=\"wp-image-876\"\/><figcaption class=\"wp-element-caption\">Figure 19 &#8211; Assign GE1 to security group VELO_vVCE_SG<\/figcaption><\/figure>\n\n\n\n<p>For Demo-Azure02-GE2 (LAN side) , assign &#8220;VELO_vVCE_LAN_SG&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1448\" height=\"982\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/GE2-Security-Group222.jpg\" alt=\"\" class=\"wp-image-878\"\/><figcaption class=\"wp-element-caption\">Figure 20 &#8211; Assign GE2 to security group VELO_vVCE_LAN_SG<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Public IP Address<\/h2>\n\n\n\n<p>The WAN interface which is Demo-Azure01-GE1 requires a public IP address. Go to &#8220;Public IP addresses&#8221; and click &#8220;Create&#8221;. Give a name to the public IP, here is &#8220;Demo-Azure01-PublicIP&#8221;. Select IPv4, Standard SKU, Zone-redundant and Regional Tier, click &#8220;Review + create&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1136\" height=\"987\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/R-and-Create-Screen1.jpg\" alt=\"\" class=\"wp-image-880\"\/><figcaption class=\"wp-element-caption\">Figure 21 &#8211; Create Public IP address, upper part<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1120\" height=\"972\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/R-and-Create-Screen2.jpg\" alt=\"\" class=\"wp-image-881\"\/><figcaption class=\"wp-element-caption\">Figure 22 &#8211; Create Public IP address, lower part<\/figcaption><\/figure>\n\n\n\n<p>Click Create after Validation passed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"985\" height=\"979\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-Public-IP-111.jpg\" alt=\"\" class=\"wp-image-882\"\/><figcaption class=\"wp-element-caption\">Figure 23 &#8211; Validation passed and create public IP address<\/figcaption><\/figure>\n\n\n\n<p>Associate the public IP address to NIC Demo-Azure01-GE1 (GE1 is WAN). Click on the NIC Demo-Azure01-GE1, go to &#8220;IP configurations&#8221; -&gt; &#8220;IP Settings&#8221; -&gt; &#8220;ipv4config&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2535\" height=\"968\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/ip-config-ip-settings.jpg\" alt=\"\" class=\"wp-image-884\"\/><figcaption class=\"wp-element-caption\">Figure 24 &#8211; &#8220;IP configurations&#8221; -&gt; &#8220;IP Settings&#8221; -&gt; &#8220;ipv4config&#8221; of Demo-Azure01-GE1<\/figcaption><\/figure>\n\n\n\n<p>Enable &#8220;Associate public IP address&#8221;, in the Public IP address drop down menu, select the IP created in the previous step, in this case is demo-azure01-publicip:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2536\" height=\"976\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Associate-GE1-public.jpg\" alt=\"\" class=\"wp-image-886\"\/><figcaption class=\"wp-element-caption\">Figure 25 &#8211; Associate the public IP address to NIC Demo-Azure01-GE1<\/figcaption><\/figure>\n\n\n\n<p>After associate public IP address to NIC Demo-Azure01-GE1:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2056\" height=\"983\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/After-assigned-pub-ip.jpg\" alt=\"\" class=\"wp-image-889\"\/><figcaption class=\"wp-element-caption\">Figure 26 &#8211; After associate public IP address to Demo-Azure01-GE1<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Enable IP Forwarding<\/h2>\n\n\n\n<p>On GE2 (LAN side), IP Forwarding needs to be enabled. Click on NIC Demo-Azure01-GE2, go to &#8220;IP configurations&#8221; -&gt; &#8220;IP  Settings&#8221;, check the &#8220;Enable IP forwarding&#8221; checkbox and click Apply:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1761\" height=\"983\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/enable-ipforward-1.jpg\" alt=\"\" class=\"wp-image-891\"\/><figcaption class=\"wp-element-caption\">Figure 27 &#8211; Enable IP forwarding for Demo-Azure01-GE2 (LAN)<\/figcaption><\/figure>\n\n\n\n<p>After enabled &#8220;Enable IP forwarding&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1610\" height=\"977\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/enable-ipforward-2.jpg\" alt=\"\" class=\"wp-image-892\"\/><figcaption class=\"wp-element-caption\">Figure 28 &#8211; After enable &#8220;Enable IP forwarding&#8221;<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Create the Virtual VCE VM<\/h2>\n\n\n\n<p><mark style=\"background-color:#fcb900\" class=\"has-inline-color has-black-color\">NOTE: Please make sure you understand the &#8220;Custom data&#8221; configuration before create the VM<\/mark>. Go to &#8220;Images&#8221; and click on the &#8220;Velocloud-5015-Image&#8221; created in this article. Next, select &#8220;Create VM&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2466\" height=\"975\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-VM-from-images.jpg\" alt=\"\" class=\"wp-image-894\"\/><figcaption class=\"wp-element-caption\">Figure 29 &#8211; Create VM from image Velocloud-5015-Image<\/figcaption><\/figure>\n\n\n\n<p>For the VM name, in this article will call Demo-Azure01<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1284\" height=\"989\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-VM-Screen1.jpg\" alt=\"\" class=\"wp-image-895\"\/><figcaption class=\"wp-element-caption\">Figure 30 &#8211; Create VM and call it Demo-Azure01<\/figcaption><\/figure>\n\n\n\n<p>The image should already selected as Velocloud-5015-Image x64 Gen1. For the Size, you need to select the size suitable for your environment and requirement. For this demonstration, Standard_D2s_v5 is selected:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1252\" height=\"977\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-VM-Screen2.jpg\" alt=\"\" class=\"wp-image-897\"\/><figcaption class=\"wp-element-caption\">Figure 31 &#8211; Create VM from image Velocloud-5015-Image &#8211; continue<\/figcaption><\/figure>\n\n\n\n<p>For the Authentication type, as mentioned at the beginning, since we want to able to login with serial console, so select &#8220;Password&#8221; as Authentication type. In this article, the username is &#8220;azureuser&#8221; and the password is &#8220;Velocloudsdwan2&#8221;.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1311\" height=\"981\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-VM-Screen-n3.jpg\" alt=\"\" class=\"wp-image-898\"\/><figcaption class=\"wp-element-caption\">Figure 32 &#8211; Create VM from image Velocloud-5015-Image, Authentication Setting<\/figcaption><\/figure>\n\n\n\n<p>Do NOT click &#8220;Review + create&#8221; at this point. Instead click &#8220;Next: Disks &gt;&#8221;, no need to change the Disks setting, that is use default for Disks. Then click &#8220;Next: Networking &gt;&#8221;, In the networking section, do not assign a new Public IP. The NIC created here is going to unbind and deleted at the end (remember we created two NICs previously).<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1390\" height=\"987\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/networking1.jpg\" alt=\"\" class=\"wp-image-900\"\/><figcaption class=\"wp-element-caption\">Figure 33 &#8211; Networking setting when create VM from image Velocloud-5015-Image<\/figcaption><\/figure>\n\n\n\n<p>Then click &#8220;Next: Management &gt;&#8221;. Use default and click &#8220;Next: Monitoring &gt;&#8221;, again use default and click &#8220;Next: Advanced &gt;&#8221;. <mark style=\"background-color:#fcb900\" class=\"has-inline-color\"><strong>And here we arrive at the &#8220;Advanced&#8221; tab which is the very important part<\/strong><\/mark>. There is a Custom data box, which allow us to input the cloud-init data. The following code box is the cloud-init configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#cloud-config\nvelocloud:\n  vce:\n    management_interface:\n      false\nwrite_files:\n  -  content: |\n       # User rules for azureuser\n       azureuser ALL=(ALL) NOPASSWD:ALL\n     owner: root:root\n     path: \/etc\/sudoers.d\/azureuser\n     permissions: '0644'<\/code><\/pre>\n\n\n\n<p>There are two configurations and hence two purposes will be achieved. Firstly, line #2 to line #5, which configured the management interface as false. Thus, the first interface will not be acting as a management interface, which means it can be work as a WAN interface. As a result, a 2-ARM deployment is possible by disable the management interface.<\/p>\n\n\n\n<p>Secondly is about line #6 to line #12. These 6 lines write a file called \/etc\/sudoers.d\/azureuser, such that azureuser will be able to sudo. This is a kind of workaround. By default, if the user is using key-based authentication, the user will be put into the sudoer list. But if the user is using password (in this article), the user will not be in the sudoer list. Thus, we use this trick to make the user azureuser use password for authentication but still able to sudo. If we do not use this workaround, none of the user can perform sudo and make the VCE not possible to perform necessary troubleshooting in the shell.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1282\" height=\"980\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/custom-data-1.jpg\" alt=\"\" class=\"wp-image-902\"\/><figcaption class=\"wp-element-caption\">Figure 34 &#8211; Custom data (upper part of the box)<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1287\" height=\"982\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/custom-data-2.jpg\" alt=\"\" class=\"wp-image-903\"\/><figcaption class=\"wp-element-caption\">Figure 35 &#8211; Custom data (lower part of the box)<\/figcaption><\/figure>\n\n\n\n<p>At this point, can click &#8220;Review + create&#8221;, click the &#8220;Create&#8221; after Validation passed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1458\" height=\"986\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Create-after-validation-pass-VM.jpg\" alt=\"\" class=\"wp-image-904\"\/><figcaption class=\"wp-element-caption\">Figure 36 &#8211; Create the VM Demo-Azure01<\/figcaption><\/figure>\n\n\n\n<p>The VM Demo-Azure01 will be created and running like this after the creation:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2505\" height=\"976\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/VM-Created.jpg\" alt=\"\" class=\"wp-image-906\"\/><figcaption class=\"wp-element-caption\">Figure 37 &#8211; VM Demo-Azure01 right after create<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Detach and Attach Network Interface<\/h2>\n\n\n\n<p>In previous section, network interface Demo-Azure01-GE1 and Demo-Azure01-GE2 are created. We need to attach them to the VM Demo-Azure01. To perform network interface attach and detach, the VM Demo-Azure01 needs to be power off first. NOTE: When the virtual VCE VM is created in first time, wait for 10 minutes before doing this power off, this allow the VM completely initialized.<\/p>\n\n\n\n<p>Click Stop to power off the VM Demo-Azure01. After the VM Demo-Azure01 is off, the status is &#8220;Stopped (deallocated)&#8221; as follow:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2440\" height=\"950\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/VM-Powered-Off.jpg\" alt=\"\" class=\"wp-image-909\"\/><figcaption class=\"wp-element-caption\">Figure 38 &#8211; VM Demo-Azure01 powered off<\/figcaption><\/figure>\n\n\n\n<p>Go to &#8220;Networking&#8221; -&gt; &#8220;Network settings&#8221; and click &#8220;Attach network interface&#8221;, see the highlight of the following screen.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2472\" height=\"944\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/attach-network-interface01.jpg\" alt=\"\" class=\"wp-image-910\"\/><figcaption class=\"wp-element-caption\">Figure 39 &#8211; Attach network interface (1st time)<\/figcaption><\/figure>\n\n\n\n<p>Select Demo-Azure01-GE1 from the drop-down menu and click &#8220;Ok&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1877\" height=\"952\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/selec-GE1-click-ok.jpg\" alt=\"\" class=\"wp-image-911\"\/><figcaption class=\"wp-element-caption\">Figure 40 &#8211; Select Demo-Azure01-GE1 and click Ok<\/figcaption><\/figure>\n\n\n\n<p>After the Demo-Azure01-GE1, select Detach network interface like the following screen capture:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2473\" height=\"930\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Detach-interface1.jpg\" alt=\"\" class=\"wp-image-912\"\/><figcaption class=\"wp-element-caption\">Figure 41 &#8211; Detach network interface<\/figcaption><\/figure>\n\n\n\n<p>In the drop down menu, select the interface created with the VMs. The interface name should be with prefix of the VM name, in this example is demo-azure01 and following with some random characters. In the other words, detach the interface which is not created by us manually in previous step. Click &#8220;Ok&#8221; after selected the interface to detach.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1910\" height=\"952\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/detach-interface-create-with-vm4.jpg\" alt=\"\" class=\"wp-image-913\"\/><figcaption class=\"wp-element-caption\">Figure 42 &#8211; detach the interface not manually created by us<\/figcaption><\/figure>\n\n\n\n<p>After detached the interface not created by us, click Attach network interface again, and select the Demo-Azure01-GE2 interface, and click Ok.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1909\" height=\"819\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/attach-ge2.jpg\" alt=\"\" class=\"wp-image-915\"\/><figcaption class=\"wp-element-caption\">Figure 43 &#8211; Attach interface Demo-Azure01-GE2<\/figcaption><\/figure>\n\n\n\n<p>After attach network interface GE2, the VM Demo-Azure01 is now with 2 network interfaces as follow:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1972\" height=\"823\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/two-interfaces.jpg\" alt=\"\" class=\"wp-image-917\"\/><figcaption class=\"wp-element-caption\">Figure 44 &#8211; VM Demo-Azure01 comes with two interfaces Demo-Azure01-GE1 and Demo-Azure01-GE2<\/figcaption><\/figure>\n\n\n\n<p>The network interface detach and attach are completed, power on (start) the VM Demo-Azure01.<\/p>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Route Table<\/h2>\n\n\n\n<p>The VM is now ready to login and activate. For completeness, I capture the route table of the public subnet, which is where the GE1 located at, and also the route table of the server subnet, which is where the servers are located.<\/p>\n\n\n\n<p>The public subnet comes with a default route (0.0.0.0\/0) to Internet.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1868\" height=\"815\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/public-route-table.jpg\" alt=\"\" class=\"wp-image-920\"\/><figcaption class=\"wp-element-caption\">Figure 45 &#8211; public subnet route table<\/figcaption><\/figure>\n\n\n\n<p>The server subnet in this example has two routes. The first one is default route pointing to 172.20.1.13 which is Demo-Azure01-GE2. The second route is to a subnet 10.11.1.0\/24, this subnet is at the LAN side of a remote VCE acting as a spoke site. Have two routes so the private destination and Internet are separated. And administrator can adjust the route table to their own need.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1834\" height=\"804\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/server-subnet-route-table.jpg\" alt=\"\" class=\"wp-image-922\"\/><figcaption class=\"wp-element-caption\">Figure 46 &#8211; server subnet route table<\/figcaption><\/figure>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Login to the VCE Demo-Azure01 at the serial console<\/h2>\n\n\n\n<p>At the VM Demo-Azure01, go to &#8220;Connect&#8221; -&gt; &#8220;Connect&#8221; -&gt; &#8220;More ways to connect&#8221; -&gt; &#8220;Serial console&#8221; and click on the &#8220;Go to serial console&#8221;:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1988\" height=\"971\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/serial-console8.jpg\" alt=\"\" class=\"wp-image-925\"\/><figcaption class=\"wp-element-caption\">Figure 47 &#8211; Go to serial console<\/figcaption><\/figure>\n\n\n\n<p>Press enter and the login prompt like the following appear:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1911\" height=\"940\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/serial-login-prompt.jpg\" alt=\"\" class=\"wp-image-926\"\/><figcaption class=\"wp-element-caption\">Figure 48 &#8211; serial console login prompt<\/figcaption><\/figure>\n\n\n\n<p>Login with the corresponding username and password, in this article, the username is &#8220;azureuser&#8221;, password is &#8220;velocloudsdwan2&#8221;. After login, can issue a command &#8220;sudo ls -l \/etc\/sudoers.d\/&#8221; to confirm the sudo is allowed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1399\" height=\"861\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/logged-in-to-serial-console.jpg\" alt=\"\" class=\"wp-image-927\"\/><figcaption class=\"wp-element-caption\">Figure 49 &#8211; logged in the serial console, sudo is successful<\/figcaption><\/figure>\n\n\n\n<p>Now, create the VCE at the VCO, so this Demo-Azure01 can be activated.<\/p>\n\n\n\n<!--nextpage-->\n\n\n\n<h2 class=\"wp-block-heading\">Create the VCE Demo-Azure01 in the VCO<\/h2>\n\n\n\n<p>The purpose of this article is not to show how to configure the VCE in the VCO when the VCE is a virtual VCE in Azure. Thus, here will not capture the entire configuration, only four screen captures will be shown which are the area I would like to make a reminder.<\/p>\n\n\n\n<p>Firstly, when create the edge, the mode is &#8220;Virtual Edge&#8221;, do NOT select &#8220;Cloud Edge&#8221;.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1662\" height=\"888\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Model-Virtual.jpg\" alt=\"\" class=\"wp-image-930\"\/><figcaption class=\"wp-element-caption\">Figure 50 &#8211; Use model Virtual Edge, not Cloud Edge<\/figcaption><\/figure>\n\n\n\n<p>For the interface, make sure GE1 and GE2 are both routed. and GE1 is WAN (overlay enabled) while GE2 is LAN (overlay disabled). And the GE2 (LAN) needs to have NAT Direct disabled.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2175\" height=\"907\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Interface-setting1.jpg\" alt=\"\" class=\"wp-image-931\"\/><figcaption class=\"wp-element-caption\">Figure 51 &#8211; Demo-Azure01 interface settings<\/figcaption><\/figure>\n\n\n\n<p>Thirdly, configure the static routes to the server subnet (or any other static routes required in your Azure environment).<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2184\" height=\"912\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/vce-route-table-4444.jpg\" alt=\"\" class=\"wp-image-949\"\/><figcaption class=\"wp-element-caption\">Figure 52 &#8211; static route for Azure server subnet<\/figcaption><\/figure>\n\n\n\n<p>Lastly, by default the console port access is disabled. Go to the &#8220;Firewall&#8221; -&gt; &#8220;Edge Security&#8221; -&gt; &#8220;Edge Access&#8221; -&gt; &#8220;Console Access&#8221; and select Allow. Otherwise, the serial console cannot be used after activation.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1631\" height=\"894\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/console-access-firewall.jpg\" alt=\"\" class=\"wp-image-933\"\/><figcaption class=\"wp-element-caption\">Figure 53 &#8211; Set the console access to allow<\/figcaption><\/figure>\n\n\n\n<p>At this point, it is ready to activate the VCE Demo-Azure01.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Activate the VCE Demo-Azure01<\/h2>\n\n\n\n<p>Login to the serial console, issue command in the code block below (you need to adjust the activation key and VCO URL to suit your own environment):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo \/opt\/vc\/bin\/activate.py -s vco7-sin1.velocloud.net -i ABCD-ABCD-ABCD-ABCD<\/code><\/pre>\n\n\n\n<p>The following is a sample screen capture when the activation is success<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1510\" height=\"860\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/activate-success4.jpg\" alt=\"\" class=\"wp-image-935\"\/><figcaption class=\"wp-element-caption\">Figure 54 &#8211; activation success (VCE update the software)<\/figcaption><\/figure>\n\n\n\n<p>After the activation is success, the VCE needs to update the software, establish tunnel to the controller, etc, etc. If things go right, wait for about 10 minutes, the VCO monitor section should see the VCE is at &#8220;Connected&#8221; status and the WAN link is at stable status similar to the following screen capture.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"2182\" height=\"903\" src=\"https:\/\/www.sdwan2.com\/wp-content\/uploads\/2025\/05\/Monitor-page.jpg\" alt=\"\" class=\"wp-image-938\"\/><figcaption class=\"wp-element-caption\">Figure 55 &#8211; The Demo-Azure01 VCE is at connected status, the WAN link is showing as up<\/figcaption><\/figure>\n\n\n\n<p>When I write this article, the software version the Demo-Azure01 is <strong>R5241-20241112-GA-5008849603<\/strong>. Since the vhd image is version 5.0.1, I assume there will be no issue if your target version is newer tan 5.0.1. But if you are going to downgrade, then you need to test it by yourself whether it will work or not.<\/p>\n\n\n\n<p>This conclude the manual deployment (without using template) of virtual VCE in Azure is successful.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p>This article demonstrates how to deploy virtual VCE in Azure manually, which can be useful in situation such as Azure China where the Velocloud image is not available in the marketplace.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>About VCE in Azure &#8211; the background To deploy a virtual Velocloud Edge (VCE) at Azure, typically, you will use the &#8220;Template specs&#8221; in Azure, which you upload a JSON file as template (There is one of the template by Velocloud: https:\/\/community.broadcom.com\/communities\/community-home\/librarydocuments\/viewdocument?DocumentKey=04598214-527e-46b1-9fa9-4e30bdba4da0). In the backend, the template will utilize the VCE image in the Azure [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"zakra_sidebar_layout":"customizer","zakra_remove_content_margin":false,"zakra_sidebar":"customizer","zakra_transparent_header":"customizer","zakra_logo":0,"zakra_main_header_style":"default","zakra_menu_item_color":"","zakra_menu_item_hover_color":"","zakra_menu_item_active_color":"","zakra_menu_active_style":"","zakra_page_header":true,"footnotes":""},"categories":[11,5],"tags":[],"class_list":["post-840","post","type-post","status-publish","format-standard","hentry","category-public-cloud","category-velocloud"],"_links":{"self":[{"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/posts\/840","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/comments?post=840"}],"version-history":[{"count":77,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/posts\/840\/revisions"}],"predecessor-version":[{"id":980,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/posts\/840\/revisions\/980"}],"wp:attachment":[{"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/media?parent=840"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/categories?post=840"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sdwan2.com\/index.php\/wp-json\/wp\/v2\/tags?post=840"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}