|
| 1 | +--- |
| 2 | +title: Configure User VPN P2S clients - certificate authentication - Windows native client |
| 3 | +titleSuffix: Azure Virtual WAN |
| 4 | +description: Learn how to configure the native VPN client on a Windows computer for User VPN (point-to-site) certificate authentication connections. |
| 5 | +author: cherylmc |
| 6 | +ms.service: azure-virtual-wan |
| 7 | +ms.topic: how-to |
| 8 | +ms.date: 02/07/2025 |
| 9 | +ms.author: cherylmc |
| 10 | +--- |
| 11 | + |
| 12 | +# Configure native VPN client for User VPN P2S certificate authentication connections - Windows |
| 13 | + |
| 14 | +If your User VPN point-to-site (P2S) gateway is configured to use IKEv2/SSTP and certificate authentication, you can connect to your virtual network using the native VPN client that's part of your Windows operating system. This article walks you through the steps to configure the native VPN client and connect to your virtual network. |
| 15 | + |
| 16 | +The VPN client configuration files that you generate are specific to the P2S User VPN gateway configuration. If there are any changes to the P2S VPN configuration after you generate the files, such as changes to the VPN protocol type or authentication type, you need to generate new VPN client configuration files and apply the new configuration to all of the VPN clients that you want to connect. |
| 17 | + |
| 18 | +## Before you begin |
| 19 | + |
| 20 | +This article applies to Windows operating system clients. Before beginning client configuration steps, verify that you're on the correct VPN client configuration article. The following table shows the configuration articles available for User VPN clients. Steps differ, depending on the authentication type, tunnel type, and the client OS. |
| 21 | + |
| 22 | +[!INCLUDE [P2S client configuration articles](../../includes/virtual-wan-vpn-client-install-articles.md)] |
| 23 | + |
| 24 | +### Prerequisites |
| 25 | + |
| 26 | +This article assumes that you've already performed the following prerequisites: |
| 27 | + |
| 28 | +* You configured a virtual WAN according to the steps in the [Create User VPN point-to-site connections](virtual-wan-point-to-site-portal.md) article. Your User VPN configuration must use certificate authentication and the OpenVPN tunnel type. |
| 29 | +* You generated and downloaded the VPN client configuration files. For steps to generate a VPN client profile configuration package, see [Generate VPN client configuration files](virtual-wan-point-to-site-portal.md#download). |
| 30 | +* You can either generate client certificates, or acquire the appropriate client certificates necessary for authentication. |
| 31 | + |
| 32 | +### Workflow |
| 33 | + |
| 34 | +The workflow for this article is as follows: |
| 35 | + |
| 36 | +1. Generate and install client certificates if you haven't already done so. |
| 37 | +1. View the VPN client profile configuration files contained in the VPN client profile configuration package that you generated. |
| 38 | +1. Configure the native VPN client that's already installed on your Windows computer. |
| 39 | +1. Connect to Azure. |
| 40 | + |
| 41 | +## <a name="certificates"></a>Install client certificates |
| 42 | + |
| 43 | +When your User VPN configuration settings are configured for certificate authentication, in order to authenticate, a client certificate must be installed on each connecting client computer. Later in this article, you specify the client certificates that you install in this section. The client certificate that you install must have been exported with its private key, and must contain all certificates in the certification path. |
| 44 | + |
| 45 | +* For steps to generate a client certificate, see [Generate and export certificates](certificates-point-to-site.md#clientcert). |
| 46 | + |
| 47 | +* For steps to install a client certificate see [Install client certificates](install-client-certificates.md). |
| 48 | + |
| 49 | +* To view an installed client certificate, open **Manage User Certificates**. The client certificate is installed in **Current User\Personal\Certificates**. |
| 50 | + |
| 51 | +## <a name="generate"></a>View configuration files |
| 52 | + |
| 53 | +The VPN client profile configuration package contains specific folders. The files within the folders contain the settings needed to configure the VPN client profile on the client computer. The files and the settings they contain are specific to the VPN gateway and the type of authentication and tunnel your VPN gateway is configured to use. |
| 54 | + |
| 55 | +Locate and unzip the VPN client profile configuration package you generated. For certificate authentication and IKEv2/SSTP, you'll see the following files: |
| 56 | + |
| 57 | +* **WindowsAmd64** and **WindowsX86** contain the Windows 64-bit and 32-bit installer packages, respectively. The **WindowsAmd64** installer package is for all supported 64-bit Windows clients, not just AMD. |
| 58 | +* **Generic** contains general information used to create your own VPN client configuration. The Generic folder is provided if IKEv2 or SSTP+IKEv2 was configured on the gateway. If only SSTP is configured, then the Generic folder isn’t present. |
| 59 | + |
| 60 | +## <a name="native"></a>Connect |
| 61 | + |
| 62 | +If you specified the IKEv2 VPN tunnel type for the User VPN configuration, you can connect using the Windows native VPN client already installed on your computer. |
| 63 | + |
| 64 | +1. Select the VPN client configuration files that correspond to the architecture of the Windows computer. For a 64-bit processor architecture, choose the 'VpnClientSetupAmd64' installer package. For a 32-bit processor architecture, choose the 'VpnClientSetupX86' installer package. |
| 65 | + |
| 66 | +1. Double-click the package to install it. If you see a SmartScreen popup, select **More info**, then **Run anyway**. |
| 67 | + |
| 68 | +1. On the client computer, go to your VPN page and select the connection that you configured. Then, click **Connect**. |
| 69 | + |
| 70 | +## Next steps |
| 71 | + |
| 72 | +To modify additional P2S User VPN connection settings, see [Tutorial: Create a P2S User VPN connection](virtual-wan-point-to-site-portal.md). |
0 commit comments