crypto ikev2 keyring AZURE_KEYS
 peer AZURE_TUNNEL_1
  address 20.115.98.33
  pre-shared-key local T5U7GCljSzr05njYQuDgL3quzeoupF55
  pre-shared-key remote T5U7GCljSzr05njYQuDgL3quzeoupF55

 peer AZURE_TUNNEL_2
  address 20.115.98.21
  pre-shared-key local T5U7GCljSzr05njYQuDgL3quzeoupF55
  pre-shared-key remote T5U7GCljSzr05njYQuDgL3quzeoupF55

crypto ikev2 proposal IKEV2_PROPOSAL_AZURE 
 encryption aes-gcm-256
 prf sha256
 group 14

crypto ikev2 policy IKEV2_POLICY_AZURE 
 match address local 204.186.19.10
 proposal IKEV2_PROPOSAL_AZURE

crypto ikev2 profile IKEV2_PROFILE_AZURE
 match address local interface GigabitEthernet1
 match identity remote address 20.115.98.33 255.255.255.255 
 match identity remote address 20.115.98.21 255.255.255.255 
 identity local address 204.186.19.10
 authentication remote pre-share
 authentication local pre-share
 keyring local AZURE_KEYS
 dpd 10 2 on-demand

crypto ipsec transform-set TS_AZURE esp-gcm 256 
 mode tunnel

crypto ipsec profile IPSEC_PROFILE_AZURE
 set security-association lifetime seconds 27000
 set transform-set TS_AZURE 
 set ikev2-profile IKEV2_PROFILE_AZURE

interface Tunnel3
 description TO_AZURE_VNG
 ip address 169.254.0.3 255.255.255.255
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet1
 tunnel mode ipsec ipv4
 tunnel destination 20.115.98.33
 tunnel protection ipsec profile IPSEC_PROFILE_AZURE

interface Tunnel4
 description TO_AZURE_VNG
 ip address 169.254.0.4 255.255.255.255
 ip mtu 1400
 ip tcp adjust-mss 1360
 tunnel source GigabitEthernet1
 tunnel mode ipsec ipv4
 tunnel destination 20.115.98.21
 tunnel protection ipsec profile IPSEC_PROFILE_AZURE