Before you connect your on-premises network to Azure ( whether through a Virtual Network Gateway or a third-party Network Virtual Appliance “NVA”), it helps to understand the protocol behind secure site-to-site tunnels. IKEv2 (Internet Key Exchange version 2) is the protocol that negotiates and secures the tunnel between the two ends, handling everything from key exchange to authentication to the data channel itself.

The interactive walkthrough below breaks IKEv2 down stage by stage — from the initial handshake to a fully secured, encrypted tunnel — so you can see exactly what each side is doing at every step. Use the Next and Previous buttons (or your keyboard’s arrow keys) to move through it.