Skip to content

Commit 71d85c8

Browse files
cherylmccherylmc
committed
Format article. No new data.
update
1 parent 038f6e1 commit 71d85c8

File tree

15 files changed

+310
-276
lines changed

15 files changed

+310
-276
lines changed

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-user-tunnel/p2s4..jpg renamed to ‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-user-tunnel/disconnect.jpg

File renamed without changes.

‎articles/vpn-gateway/vpn-gateway-howto-always-on-device-tunnel.md

Lines changed: 7 additions & 139 deletions
Original file line numberDiff line numberDiff line change
@@ -7,155 +7,23 @@ author: cherylmc
77

88
ms.service: vpn-gateway
99
ms.topic: conceptual
10-
ms.date: 12/11/2019
10+
ms.date: 03/12/2020
1111
ms.author: cherylmc
1212

1313
---
1414
# Configure an Always On VPN device tunnel
1515

16-
One of the new features of the Windows 10 Virtual Private Network (VPN) client is the ability to maintain a VPN connection. Always On is a Windows 10 feature that enables the active VPN profile to connect automatically and remain connected based on triggers — namely, user sign-in, network state change, or device screen active.
16+
[!INCLUDE [intro](../../includes/vpn-gateway-vwan-always-on-intro.md)]
1717

18-
Azure virtual network gateways can be used with Windows 10 Always On to establish persistent user tunnels as well as device tunnels to Azure. This article will help you configure an Always ON VPN device tunnel.
18+
## Configure the gateway
1919

20-
Always On VPN connections include two types of tunnels:
20+
Configure the VPN gateway to use IKEv2 and certificate-based authentication using the [Configure a Point-to-Site VPN connection](vpn-gateway-howto-point-to-site-resource-manager-portal.md) article.
2121

22-
* **Device tunnel** connects to specified VPN servers before users sign in the device. Pre-login connectivity scenarios and device management purposes use device tunnel.
22+
## Configure the device tunnel
2323

24-
* **User tunnel** connects only after a user sign in the device. User tunnel allows users to access organization resources through VPN servers.
24+
[!INCLUDE [device tunnel](../../includes/vpn-gateway-vwan-always-on-device.md)]
2525

26-
Both Device tunnel and User tunnel operate independently with their VPN profiles. They can be connected at the same time, and can use different authentication methods and other VPN configuration settings as appropriate.
27-
28-
## 1. Configure the gateway
29-
30-
Configure the VPN gateway to use IKEv2 and certificate-based authentication using this [point-to-site article](vpn-gateway-howto-point-to-site-resource-manager-portal.md).
31-
32-
## 2. Configure the device tunnel
33-
34-
The following requirements must be met in order to successfully establish a device tunnel:
35-
36-
* The device must be a domain joined computer running Windows 10 Enterprise or Education version 1809 or later.
37-
* The tunnel is only configurable for the Windows built-in VPN solution and is established using IKEv2 with computer certificate authentication.
38-
* Only one device tunnel can be configured per device.
39-
40-
1. Install client certificates on the Windows 10 client as shown in this [point-to-site VPN client article](point-to-site-how-to-vpn-client-install-azure-cert.md). The certificate needs to be in the Local Machine store.
41-
1. Use [these instructions](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/vpn-device-tunnel-config#vpn-device-tunnel-configuration) to create a VPN Profile and configure device tunnel in the context of the LOCAL SYSTEM account.
42-
43-
### Configuration example for device tunnel
44-
45-
After you have configured the virtual network gateway and installed the client certificate in the Local Machine store on the Windows 10 client, use the following examples to configure a client device tunnel.
46-
47-
1. Copy the following text and save it as ***devicecert.ps1***.
48-
49-
```
50-
Param(
51-
[string]$xmlFilePath,
52-
[string]$ProfileName
53-
)
54-
55-
$a = Test-Path $xmlFilePath
56-
echo $a
57-
58-
$ProfileXML = Get-Content $xmlFilePath
59-
60-
echo $XML
61-
62-
$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
63-
64-
$Version = 201606090004
65-
66-
$ProfileXML = $ProfileXML -replace '<', '&lt;'
67-
$ProfileXML = $ProfileXML -replace '>', '&gt;'
68-
$ProfileXML = $ProfileXML -replace '"', '&quot;'
69-
70-
$nodeCSPURI = './Vendor/MSFT/VPNv2'
71-
$namespaceName = "root\cimv2\mdm\dmmap"
72-
$className = "MDM_VPNv2_01"
73-
74-
$session = New-CimSession
75-
76-
try
77-
{
78-
$newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
79-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
80-
$newInstance.CimInstanceProperties.Add($property)
81-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
82-
$newInstance.CimInstanceProperties.Add($property)
83-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
84-
$newInstance.CimInstanceProperties.Add($property)
85-
86-
$session.CreateInstance($namespaceName, $newInstance)
87-
$Message = "Created $ProfileName profile."
88-
Write-Host "$Message"
89-
}
90-
catch [Exception]
91-
{
92-
$Message = "Unable to create $ProfileName profile: $_"
93-
Write-Host "$Message"
94-
exit
95-
}
96-
$Message = "Complete."
97-
Write-Host "$Message"
98-
```
99-
1. Copy the following text and save it as ***VPNProfile.xml*** in the same folder as **devicecert.ps1**. Edit the following text to match your environment.
100-
101-
* `<Servers>azuregateway-1234-56-78dc.cloudapp.net</Servers> <= Can be found in the VpnSettings.xml in the downloaded profile zip file`
102-
* `<Address>192.168.3.5</Address> <= IP of resource in the vnet or the vnet address space`
103-
* `<Address>192.168.3.4</Address> <= IP of resource in the vnet or the vnet address space`
104-
105-
```
106-
<VPNProfile>
107-
<NativeProfile>
108-
<Servers>azuregateway-1234-56-78dc.cloudapp.net</Servers>
109-
<NativeProtocolType>IKEv2</NativeProtocolType>
110-
<Authentication>
111-
<MachineMethod>Certificate</MachineMethod>
112-
</Authentication>
113-
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
114-
<!-- disable the addition of a class based route for the assigned IP address on the VPN interface -->
115-
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
116-
</NativeProfile>
117-
<!-- use host routes(/32) to prevent routing conflicts -->
118-
<Route>
119-
<Address>192.168.3.5</Address>
120-
<PrefixSize>32</PrefixSize>
121-
</Route>
122-
<Route>
123-
<Address>192.168.3.4</Address>
124-
<PrefixSize>32</PrefixSize>
125-
</Route>
126-
<!-- need to specify always on = true -->
127-
<AlwaysOn>true</AlwaysOn>
128-
<!-- new node to specify that this is a device tunnel -->
129-
<DeviceTunnel>true</DeviceTunnel>
130-
<!--new node to register client IP address in DNS to enable manage out -->
131-
<RegisterDNS>true</RegisterDNS>
132-
</VPNProfile>
133-
```
134-
1. Download **PsExec** from [Sysinternals](https://docs.microsoft.com/sysinternals/downloads/psexec) and extract the files to **C:\PSTools**.
135-
1. From an Admin CMD prompt, launch PowerShell by running:
136-
137-
```
138-
PsExec.exe Powershell for 32-bit Windows
139-
PsExec64.exe Powershell for 64-bit Windows
140-
```
141-
142-
![powershell](./media/vpn-gateway-howto-always-on-device-tunnel/powershell.png)
143-
1. In PowerShell, switch to the folder where **devicecert.ps1** and **VPNProfile.xml** are located, and run the following command:
144-
145-
```powershell
146-
.\devicecert.ps1 .\VPNProfile.xml MachineCertTest
147-
```
148-
149-
![MachineCertTest](./media/vpn-gateway-howto-always-on-device-tunnel/machinecerttest.png)
150-
1. Run **rasphone**.
151-
152-
![rasphone](./media/vpn-gateway-howto-always-on-device-tunnel/rasphone.png)
153-
1. Look for the **MachineCertTest** entry and click **Connect**.
154-
155-
![Connect](./media/vpn-gateway-howto-always-on-device-tunnel/connect.png)
156-
1. If the connection succeeds, reboot the computer. The tunnel will connect automatically.
157-
158-
## Cleanup
26+
## To remove a profile
15927

16028
To remove the profile, run the following command:
16129

‎articles/vpn-gateway/vpn-gateway-howto-always-on-user-tunnel.md

Lines changed: 8 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -7,152 +7,23 @@ author: cherylmc
77

88
ms.service: vpn-gateway
99
ms.topic: conceptual
10-
ms.date: 10/02/2019
10+
ms.date: 03/12/2020
1111
ms.author: cherylmc
1212

1313
---
1414
# Configure an Always On VPN user tunnel
1515

16-
A new feature of the Windows 10 VPN client, Always On, is the ability to maintain a VPN connection. With Always On, the active VPN profile can connect automatically and remain connected based on triggers, such as user sign-in, network state change, or device screen active.
16+
[!INCLUDE [intro](../../includes/vpn-gateway-vwan-always-on-intro.md)]
1717

18-
You can use Azure virtual network gateways with Windows 10 Always On to establish persistent user tunnels and device tunnels to Azure. This article helps you configure an Always On VPN user tunnel.
18+
## Configure the gateway
1919

20-
Always On VPN connections include either of two types of tunnels:
20+
Use the instructions in the [Configure a Point-to-Site VPN connection](vpn-gateway-howto-point-to-site-resource-manager-portal.md) article to configure the VPN gateway to use IKEv2 and certificate-based authentication.
2121

22-
* **Device tunnel**: Connects to specified VPN servers before users sign in to the device. Pre-sign-in connectivity scenarios and device management use a device tunnel.
22+
[!INCLUDE [user configuration](../../includes/vpn-gateway-vwan-always-on-user.md)]
2323

24-
* **User tunnel**: Connects only after users sign in to the device. By using user tunnels, you can access organization resources through VPN servers.
24+
## To remove a profile
2525

26-
Device tunnels and user tunnels operate independent of their VPN profiles. They can be connected at the same time, and they can use different authentication methods and other VPN configuration settings, as appropriate.
27-
28-
In the following sections, you configure a VPN gateway and a user tunnel.
29-
30-
## Step 1: Configure a VPN gateway
31-
32-
You configure the VPN gateway to use IKEv2 and certificate-based authentication by following the instructions in this [point-to-site](vpn-gateway-howto-point-to-site-resource-manager-portal.md) article.
33-
34-
## Step 2: Configure a user tunnel
35-
36-
1. Install client certificates on the Windows 10 client, as shown in this [point-to-site VPN client](point-to-site-how-to-vpn-client-install-azure-cert.md) article. The certificate must be in the current user store.
37-
38-
1. Configure the Always On VPN client through PowerShell, Configuration Manager, or Intune by following the instructions in [Configure Windows 10 client Always On VPN connections](https://docs.microsoft.com/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections).
39-
40-
### Example configuration for the user tunnel
41-
42-
After you've configured the virtual network gateway and installed the client certificate in the local machine store on the Windows 10 client, configure a client device tunnel by using the following examples:
43-
44-
1. Copy the following text, and save it as *usercert.ps1*:
45-
46-
```
47-
Param(
48-
[string]$xmlFilePath,
49-
[string]$ProfileName
50-
)
51-
52-
$a = Test-Path $xmlFilePath
53-
echo $a
54-
55-
$ProfileXML = Get-Content $xmlFilePath
56-
57-
echo $XML
58-
59-
$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
60-
61-
$Version = 201606090004
62-
63-
$ProfileXML = $ProfileXML -replace '<', '&lt;'
64-
$ProfileXML = $ProfileXML -replace '>', '&gt;'
65-
$ProfileXML = $ProfileXML -replace '"', '&quot;'
66-
67-
$nodeCSPURI = './Vendor/MSFT/VPNv2'
68-
$namespaceName = "root\cimv2\mdm\dmmap"
69-
$className = "MDM_VPNv2_01"
70-
71-
$session = New-CimSession
72-
73-
try
74-
{
75-
$newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
76-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
77-
$newInstance.CimInstanceProperties.Add($property)
78-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
79-
$newInstance.CimInstanceProperties.Add($property)
80-
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
81-
$newInstance.CimInstanceProperties.Add($property)
82-
83-
$session.CreateInstance($namespaceName, $newInstance)
84-
$Message = "Created $ProfileName profile."
85-
Write-Host "$Message"
86-
}
87-
catch [Exception]
88-
{
89-
$Message = "Unable to create $ProfileName profile: $_"
90-
Write-Host "$Message"
91-
exit
92-
}
93-
$Message = "Complete."
94-
Write-Host "$Message"
95-
```
96-
1. Copy the following text, and save it as *VPNProfile.xml* in the same folder as *usercert.ps1*. Edit the following text to match your environment:
97-
98-
* `<Servers>azuregateway-1234-56-78dc.cloudapp.net</Servers> <= Can be found in the VpnSettings.xml in the downloaded profile zip file`
99-
* `<Address>192.168.3.5</Address> <= IP of resource in the vnet or the vnet address space`
100-
* `<Address>192.168.3.4</Address> <= IP of resource in the vnet or the vnet address space`
101-
* `<PrefixSize>32</PrefixSize> <= Subnet mask`
102-
103-
```
104-
<VPNProfile>
105-
<NativeProfile>
106-
<Servers>azuregateway-b115055e-0882-49bc-a9b9-7de45cba12c0-8e6946892333.vpn.azure.com</Servers>
107-
<NativeProtocolType>IKEv2</NativeProtocolType>
108-
<Authentication>
109-
<UserMethod>Eap</UserMethod>
110-
<Eap>
111-
<Configuration>
112-
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type><EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1"><CredentialsSource><CertificateStore><SimpleCertSelection>true</SimpleCertSelection></CertificateStore></CredentialsSource><ServerValidation><DisableUserPromptForServerValidation>false</DisableUserPromptForServerValidation><ServerNames></ServerNames></ServerValidation><DifferentUsername>false</DifferentUsername><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName></EapType></Eap></Config></EapHostConfig>
113-
</Configuration>
114-
</Eap>
115-
</Authentication>
116-
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
117-
<!-- disable the addition of a class based route for the assigned IP address on the VPN interface -->
118-
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
119-
</NativeProfile>
120-
<!-- use host routes(/32) to prevent routing conflicts -->
121-
<Route>
122-
<Address>192.168.3.5</Address>
123-
<PrefixSize>32</PrefixSize>
124-
</Route>
125-
<Route>
126-
<Address>192.168.3.4</Address>
127-
<PrefixSize>32</PrefixSize>
128-
</Route>
129-
<!-- traffic filters for the routes specified above so that only this traffic can go over the device tunnel -->
130-
<TrafficFilter>
131-
<RemoteAddressRanges>192.168.3.4, 192.168.3.5</RemoteAddressRanges>
132-
</TrafficFilter>
133-
<!-- need to specify always on = true -->
134-
<AlwaysOn>true</AlwaysOn>
135-
<RememberCredentials>true</RememberCredentials>
136-
<!--new node to register client IP address in DNS to enable manage out -->
137-
<RegisterDNS>true</RegisterDNS>
138-
</VPNProfile>
139-
```
140-
1. Run PowerShell as an administrator.
141-
142-
1. In PowerShell, switch to the folder where *usercert.ps1* and *VPNProfile.xml* are located, and run the following command:
143-
144-
```powershell
145-
C:\> .\usercert.ps1 .\VPNProfile.xml UserTest
146-
```
147-
148-
![MachineCertTest](./media/vpn-gateway-howto-always-on-user-tunnel/p2s2.jpg)
149-
1. Under **VPN Settings**, look for the **UserTest** entry, and then select **Connect**.
150-
151-
1. If the connection succeeds, you've successfully configured an Always On user tunnel.
152-
153-
## Clean up your resources
154-
155-
To remove the profile, do the following:
26+
To remove a profile, use the following steps:
15627

15728
1. Run the following command:
15829

@@ -162,7 +33,7 @@ To remove the profile, do the following:
16233

16334
1. Disconnect the connection, and clear the **Connect automatically** check box.
16435

165-
![Cleanup](./media/vpn-gateway-howto-always-on-user-tunnel/p2s4..jpg)
36+
![Cleanup](./media/vpn-gateway-howto-always-on-user-tunnel/disconnect.jpg)
16637

16738
## Next steps
16839

‎includes/media/vpn-gateway-vwan-always-on-device/cleanup.png

12.2 KB
Loading

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-device-tunnel/connect.png renamed to ‎includes/media/vpn-gateway-vwan-always-on-device/connect.png

File renamed without changes.

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-device-tunnel/machinecerttest.png renamed to ‎includes/media/vpn-gateway-vwan-always-on-device/machinecerttest.png

File renamed without changes.

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-device-tunnel/powershell.png renamed to ‎includes/media/vpn-gateway-vwan-always-on-device/powershell.png

File renamed without changes.

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-device-tunnel/rasphone.png renamed to ‎includes/media/vpn-gateway-vwan-always-on-device/rasphone.png

File renamed without changes.

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-user-tunnel/p2s1.jpg renamed to ‎includes/media/vpn-gateway-vwan-always-on-user/p2s1.jpg

File renamed without changes.

‎articles/vpn-gateway/media/vpn-gateway-howto-always-on-user-tunnel/p2s2.jpg renamed to ‎includes/media/vpn-gateway-vwan-always-on-user/p2s2.jpg

File renamed without changes.

0 commit comments

Comments
 (0)