Create a S2S interface with the specified parameters.
Networking / Security · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft RemoteAccess reference: Create a S2S interface with the specified parameters. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Add-VpnS2SInterface. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / RemoteAccess · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AdminStatus
Specifies the administrator status of the cmdlet.
-AsJob
Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-AuthenticationMethod
Specifies the AuthenticationMethod to be used by the S2S connection. If a pre-shared key is specified as authentication method, there can only be one active site to site virtual private network (VPN) interface per destination IP address.
-AuthenticationTransformConstants
Specifies the authentication transform plumbed in IPsec policy.
-AutoConnectEnabled
Specifies the activation of auto-reconnection.
-Certificate
Specifies the certificate to be used in default store. Applicable only if *AuthenticationMethod* is set to MachineCert.
-CimSession
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-CipherTransformConstants
Specifies the cipher plumbed in IPsec policy.
-Confirm
Prompts you for confirmation before running the cmdlet.
-CustomPolicy (required)
Specifies the custom IKE IPsec policy.
-DHGroup
Specifies the Diffie-Hellman (DH) Group to use during IKE key exchanges. Acceptable values for this parameter are: - None - Group1 - Group2 - Group14 - ECP256 - ECP384 - Group24
-Destination (required)
Specifies the destination end-point of the S2S connection.
-EapMethod
Specifies EAP method if *IkeLocalAuthenticationMethod* is EAP.
-EnableQoS
Indicates whether to enable Quality of Service (QoS) on an interface. The acceptable values for this parameter are: - Enabled - Disabled
-EncryptionMethod
Specifies the encryption method in the IKE policy.
-EncryptionType
Specifies the type of encryption. The acceptable values for this parameter are: - NoEncryption - RequireEncryption - OptionalEncryption - MaximumEncryption
Prerequisites
Windows with the RemoteAccess module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This command creates a site-to-site VPN interface by name EDGE1 to destination 131.107.0.20. The protocol is IKEv2 and the authentication method is pre-shared key named ABC. Traffic to 10.2.0.0/24 and subnet 2001:db8:2::/48 is sent over this interface if there is no other interface on the server that has same routes with metric less than 100 . In case the interface is in disconnected state the connection is triggered if there is no other interface on the server that has same routes with metric less than 100. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.
Specifies individual traffic flows within a Generic Routing Encapsulation (GRE) tunnel.
-GreTunnel (required)
Indicates whether this cmdlet uses the GRE tunnel capability for the Windows Server Gateway.
-IPv4Address
Indicates whether the cmdlet sets custom IKE IPsec policies.
-IPv4Subnet
Specifies the IPv4 subnet that is routed on this connection with metric.
-IPv4TriggerFilter
Specifies a string array of IPv4 filters that trigger demand dial connections.
-IPv4TriggerFilterAction
Indicates whether a filter should trigger an S2S connection.
-IPv6Address
Indicates whether the cmdlet sets custom IKE IPsec policies.
-IPv6Subnet
Specifies the IPv6 subnet that is routed on this connection with metric.
-IPv6TriggerFilter
Specifies an array of IPv6 filters that trigger demand dial connections.
-IPv6TriggerFilterAction
Indicates whether a filter should trigger an S2S connection.
-IdleDisconnectSeconds
Specifies a value that specifies the time, in seconds, after which an idle connection is terminated. Unless the idle time-out is disabled, the entire connection is terminated if the connection is idle for the specified interval.
-InitiateConfigPayload
Indicates whether to initiate configuration payload negotiation.
-IntegrityCheckMethod
Specifies the integrity method plumbed in IPsec policy.
-InternalIPv4
Specifies Negotiation of IPv4 Address.
-InternalIPv6
Specifies negotiation of IPv6 Address.
-LocalVpnTrafficSelector
Specifies the initiator Traffic Selector object.
-MMSALifeTimeSeconds
Specifies the lifetime of main mode security association in seconds, after which the main mode security association is no longer valid.
-Name (required)
Specifies the name of the connection.
-NetworkOutageTimeSeconds
Specifies the maximum network outage time after which the connection is disconnected. Acceptable values for this parameter are: - 6 - 9 - 12 - 15 - 30 - 60 - 120 - 240 - 360 - 720 - 900
-NumberOfTries
Specifies the number of tries the connection is retried. If you specify 0, the cmdlet will retry infinitely.
-PassThru
Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.
-Password
Specifies the password of the username to be used for dialing the connection. Applicable only if *AuthenticationMethod* is set to EAP.
-Persistent
Indicates whether the connection state is persisted across the service restart or system reboots.
-PfsGroup
Specifies the perfect forward secrecy (PFS) Group plumbed in IPsec policy.
-PostConnectionIPv4Subnet
Specifies the IPv4 subnet routes that are added to a site-to-site interface after the connection is established. The values specified are not used to initiate the site-to-site VPN connection.
-PostConnectionIPv6Subnet
Specifies the IPv6 subnet routes that are added to a site-to-site interface after the connection is established. The values specified are not used to initiate the site-to-site VPN connection.
-PromoteAlternate
Specifies that an alternate IP address that connects successfully becomes the primary IP address, and the current primary IP address is moved to the alternate list.
-Protocol
Specifies the underlying protocol.
-RadiusAttributeClass
Specifies a RADIUS attribute.
-RemoteVpnTrafficSelector
Specifies the responder traffic selector object.
-ResponderAuthenticationMethod
Specifies the responder AuthenticationMethod to be used by the S2S connection.
-RetryIntervalSeconds
Number of seconds between retries.
-RoutingDomain
Specifies an ID, as a string, for a routing domain. The ID of a routing domain is a user-defined alphanumeric string.
-RxBandwidthKbps
Specifies the receive bandwidth limit, in kilobits per second (Kbps).
-SADataSizeForRenegotiationKilobytes
Specifies the number of kilobytes that are allowed to transfer using a security association (SA). After that the SA will be renegotiated
-SALifeTimeSeconds
Lifetime of an SA in seconds, after which the SA is no longer valid
-SharedSecret
Specifies the text of the shared secret to be used in dialing the connection. This is only applicable if *AuthenticationMethod* is set to PSK.
-SourceIpAddress (required)
Specifies the source IPv4 or IPv6 addresses to use when dialing the connection.
-ThrottleLimit
Specifies the maximum number of concurrent connections that can be established to run this command. If you omit this parameter or enter a value of 0, the default value, 32, is used. The throttle limit applies only to the current command, not to the session or to the computer.
-TxBandwidthKbps
Specifies a transmit bandwidth limit, in Kbps, for the interface.
-UserName
Specifies the username to be used for dialing this connection. This is only applicable if the *AuthenticationMethod* parameter is set to EAP.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.