You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
## Working with VPN client profile configuration files
39
39
40
-
The steps in this article require you to modify and import the Azure VPN Client profile configuration file. To work with VPN client profile configuration files (xml files), do the following:
40
+
The steps in this article require you to modify and import the Azure VPN Client profile configuration file. To work with VPN client profile configuration files (xml files), use the following steps:
41
41
42
42
1. Locate the profile configuration file and open it using the editor of your choice.
43
-
1. Using the examples in the sections below, modify the file as necessary, then save your changes.
43
+
1. Using the examples in the following sections, modify the file as necessary, then save your changes.
44
44
1. Import the file to configure the Azure VPN client. You can import the file for the Azure VPN Client using these methods:
45
45
46
46
***Azure VPN Client interface**: Open the Azure VPN Client and click **+** and then **Import**. Locate the modified xml file, configure any additional settings in the Azure VPN Client interface (if necessary), then click **Save**.
Copy file name to clipboardExpand all lines: articles/vpn-gateway/ikev2-openvpn-from-sstp.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ A point-to-site (P2S) VPN gateway connection lets you create a secure connection
17
17
18
18
Point-to-site VPN can use one of the following protocols:
19
19
20
-
***OpenVPN® Protocol**, an SSL/TLS based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which SSL uses. OpenVPN can be used to connect from Android, iOS (versions 11.0 and above), Windows, Linux and Mac devices (macOS versions 10.13 and above).
20
+
***OpenVPN® Protocol**, an SSL/TLS based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which SSL uses. OpenVPN can be used to connect from Android, iOS (versions 11.0 and above), Windows, Linux, and Mac devices (macOS versions 10.13 and above).
21
21
22
22
***Secure Socket Tunneling Protocol (SSTP)**, a proprietary SSL-based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which SSL uses. SSTP is only supported on Windows devices. Azure supports all versions of Windows that have SSTP (Windows 7 and later). **SSTP supports up to 128 concurrent connections only regardless of the gateway SKU**.
23
23
@@ -29,7 +29,7 @@ Point-to-site VPN can use one of the following protocols:
29
29
30
30
## <aname="migrate"></a>Migrating from SSTP to IKEv2 or OpenVPN
31
31
32
-
There may be cases when you want to support more than 128 concurrent P2S connection to a VPN gateway but are using SSTP. In such a case, you need to move to IKEv2 or OpenVPN protocol.
32
+
There might be cases when you want to support more than 128 concurrent P2S connection to a VPN gateway but are using SSTP. In such a case, you need to move to IKEv2 or OpenVPN protocol.
33
33
34
34
### Option 1 - Add IKEv2 in addition to SSTP on the Gateway
35
35
@@ -55,9 +55,9 @@ You can enable OpenVPN along side with IKEv2 if you desire. OpenVPN is TLS-based
55
55
56
56
:::image type="content" source="./media/ikev2-openvpn-from-sstp/change-tunnel-type.png" alt-text="Screenshot that shows the Point-to-site configuration page with Open VPN selected." lightbox="./media/ikev2-openvpn-from-sstp/change-tunnel-type.png":::
57
57
58
-
Once the gateway has been configured, existing clients won't be able to connect until you [deploy and configure the OpenVPN clients](point-to-site-vpn-client-cert-windows.md#view-openvpn).
58
+
Once the gateway has been configured, existing clients won't be able to connect until you [deploy and configure the OpenVPN clients](point-to-site-vpn-client-cert-windows.md).
59
59
60
-
If you're using Windows 10 or later, you can also use the [Azure VPN Client](point-to-site-vpn-client-cert-windows.md#azurevpn).
60
+
If you're using Windows 10 or later, you can also use the [Azure VPN Client](point-to-site-vpn-client-cert-windows.md).
Copy file name to clipboardExpand all lines: articles/vpn-gateway/point-to-site-vpn-client-cert-windows.md
+8-77Lines changed: 8 additions & 77 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: cherylmc
6
6
ms.service: vpn-gateway
7
7
ms.custom: devx-track-azurepowershell
8
8
ms.topic: how-to
9
-
ms.date: 01/25/2024
9
+
ms.date: 02/21/2024
10
10
ms.author: cherylmc
11
11
---
12
12
@@ -32,8 +32,8 @@ In this article, we start with generating VPN client configuration files and cli
32
32
1.[Generate certificates for the VPN client](#2-generate-client-certificates).
33
33
1.[Configure the VPN client](#3-configure-the-vpn-client). The steps you use to configure your VPN client depend on the tunnel type for your P2S VPN gateway, and the VPN client on the client computer.
34
34
35
-
***IKEv2 and SSTP - native VPN client steps** - If your P2S VPN gateway is configured to use IKEv2/SSTP and certificate authentication, you can connect to your VNet using the native VPN client that's part of your Windows operating system. This configuration doesn't require additional client software. For steps, see [IKEv2 and SSTP - native VPN client](point-to-site-vpn-client-certificate-windows-native.md).
36
-
***OpenVPN** - If your P2S VPN gateway is configured to use an OpenVPN tunnel and certificate authentication, you have the option of using either the [Azure VPN Client](#openvpn), or the [OpenVPN client](#azurevpn) steps in this article.
35
+
***IKEv2 and SSTP - native VPN client** - If your P2S VPN gateway is configured to use IKEv2/SSTP and certificate authentication, you connect to your VNet using the native VPN client that's part of your Windows operating system. This configuration doesn't require additional client software. For steps, see [IKEv2 and SSTP - native VPN client](point-to-site-vpn-client-certificate-windows-native.md).
36
+
***OpenVPN - Azure VPN Client and OpenVPN client** - If your P2S VPN gateway is configured to use an OpenVPN tunnel and certificate authentication, you have the option to connect using either the [Azure VPN Client](point-to-site-vpn-client-certificate-windows-azure-vpn-client.md), or the [OpenVPN client](point-to-site-vpn-client-certificate-windows-openvpn-client.md).
37
37
38
38
## 1. Generate VPN client configuration files
39
39
@@ -62,81 +62,12 @@ In many cases, you can install the client certificate directly on the client com
62
62
63
63
Next, configure the VPN client. Select from the following instructions:
64
64
65
-
*[IKEv2 and SSTP - native VPN client steps](point-to-site-vpn-client-certificate-windows-native.md)
66
-
*[OpenVPN - OpenVPN client steps](#openvpn)
67
-
*[OpenVPN - Azure VPN Client steps](#azurevpn)
65
+
|Tunnel | VPN client |
66
+
|---|---|
67
+
| IKEv2 and SSTP |[Native VPN client steps](point-to-site-vpn-client-certificate-windows-native.md)|
If your P2S VPN gateway is configured to use an OpenVPN tunnel type and certificate authentication, you can connect using the Azure VPN Client.
72
-
73
-
The following steps help you download, install, and configure the Azure VPN Client to connect to your VNet. Note that these steps apply to certificate authentication. If you're using OpenVPN with Microsoft Entra authentication, see the [Microsoft Entra ID](openvpn-azure-ad-client.md) configuration article instead.
74
-
75
-
To connect, each client computer requires the following items:
76
-
77
-
* The Azure VPN Client software must be installed on each client computer that you want to connect.
78
-
* The Azure VPN Client profile must be configured using the downloaded **azurevpnconfig.xml** configuration file.
79
-
* The client computer must have a client certificate that's installed locally.
When you open the zip file, you'll see the **AzureVPN** folder. Locate the **azurevpnconfig.xml** file. This file contains the settings you use to configure the VPN client profile.
84
-
85
-
If you don't see the file, verify the following items:
86
-
87
-
* Verify that your VPN gateway is configured to use the OpenVPN tunnel type.
88
-
* If you're using Microsoft Entra authentication, you might not have an AzureVPN folder. See the [Microsoft Entra ID](openvpn-azure-ad-client.md) configuration article instead.
89
-
90
-
### Download the Azure VPN Client
91
-
92
-
[!INCLUDE [Download the Azure VPN client](../../includes/vpn-gateway-download-vpn-client.md)]
93
-
94
-
### Configure the VPN client profile
95
-
96
-
1. Open the Azure VPN Client.
97
-
98
-
1. Click **+** on the bottom left of the page, then select **Import**.
99
-
100
-
1. In the window, navigate to the **azurevpnconfig.xml** file, select it, then click **Open**.
101
-
102
-
1. From the **Certificate Information** dropdown, select the name of the child certificate (the client certificate). For example, **P2SChildCert**. You can also (optionally) select a [Secondary Profile](#secondary-profile).
If you don't see a client certificate in the **Certificate Information** dropdown, you'll need to cancel and fix the issue before proceeding. It's possible that one of the following things is true:
107
-
108
-
* The client certificate isn't installed locally on the client computer.
109
-
* There are multiple certificates with exactly the same name installed on your local computer (common in test environments).
110
-
* The child certificate is corrupt.
111
-
112
-
1. After the import validates (imports with no errors), click **Save**.
113
-
114
-
1. In the left pane, locate the **VPN connection**, then click **Connect**.
115
-
116
-
### Optional settings for the Azure VPN Client
117
-
118
-
The following sections discuss additional optional configuration settings that are available for the Azure VPN Client.
You can configure the Azure VPN Client with optional configuration settings such as additional DNS servers, custom DNS, forced tunneling, custom routes, and other additional settings. For a description of the available settings and configuration steps, see [Azure VPN Client optional settings](azure-vpn-client-optional-configurations.md).
If your P2S VPN gateway is configured to use an OpenVPN tunnel type and certificate authentication, you can connect using an OpenVPN client. The following steps help you configure the **OpenVPN ® Protocol** client and connect to your VNet.
When you open the VPN client configuration package zip file, you should see an OpenVPN folder. If you don't see the folder, verify the following items:
135
-
136
-
* Verify that your VPN gateway is configured to use the OpenVPN tunnel type.
137
-
* If you're using Microsoft Entra authentication, you might not have an OpenVPN folder. See the [Microsoft Entra ID](openvpn-azure-ad-client.md) configuration article instead.
description: Learn how to configure VPN clients for P2S configurations that use certificate authentication. This article applies to Windows and the Azure VPN client.
5
+
author: cherylmc
6
+
ms.service: vpn-gateway
7
+
ms.topic: how-to
8
+
ms.date: 01/31/2024
9
+
ms.author: cherylmc
10
+
---
11
+
12
+
# Configure the Azure VPN Client for P2S Certificate Authentication connections
13
+
14
+
If your point-to-site (P2S) VPN gateway is configured to use OpenVPN and certificate authentication, you can connect to your virtual network using the Azure VPN Client or the OpenVPN client. This article walks you through the steps to configure the **Azure VPN Client** and connect to your virtual network.
15
+
16
+
## Before you begin
17
+
18
+
This article assumes that you've already performed the following prerequisites:
19
+
20
+
* You created and configured your VPN gateway for point-to-site certificate authentication and the OpenVPN tunnel type. See [Configure server settings for P2S VPN Gateway connections - certificate authentication](vpn-gateway-howto-point-to-site-resource-manager-portal.md) for steps.
21
+
* You generated client certificates and downloaded the VPN client configuration files. See [Point-to-site VPN clients: certificate authentication - Windows ](point-to-site-vpn-client-cert-windows.md)
22
+
23
+
Before beginning client configuration steps, verify that you're on the correct VPN client configuration article. The following table shows the configuration articles available for VPN Gateway point-to-site VPN clients. Steps differ, depending on the authentication type, tunnel type, and the client OS.
To connect to Azure, each connecting client computer requires the following items:
30
+
31
+
* The Azure VPN Client software must be installed on each client computer.
32
+
* The Azure VPN Client profile must be configured using the downloaded **azurevpnconfig.xml** configuration file.
33
+
* The client computer must have a client certificate that's installed locally.
34
+
35
+
## View configuration files
36
+
37
+
The VPN client profile configuration package contains specific folders. The files within the folders contain the settings needed to configure the VPN client profile on the client computer. The files and the settings they contain are specific to the VPN gateway and the type of authentication and tunnel your VPN gateway is configured to use.
38
+
39
+
Locate and unzip the VPN client profile configuration package you generated. For Certificate authentication and OpenVPN, you'll see the **AzureVPN** folder. Locate the **azurevpnconfig.xml** file. This file contains the settings you use to configure the VPN client profile.
40
+
41
+
If you don't see the file, verify the following items:
42
+
43
+
* Verify that your VPN gateway is configured to use the OpenVPN tunnel type.
44
+
* If you're using Microsoft Entra authentication, you might not have an AzureVPN folder. See the [Microsoft Entra ID](openvpn-azure-ad-client.md) configuration article instead.
45
+
46
+
## Download the Azure VPN Client
47
+
48
+
[!INCLUDE [Download the Azure VPN client](../../includes/vpn-gateway-download-vpn-client.md)]
49
+
50
+
## Configure the Azure VPN Client profile
51
+
52
+
1. Open the Azure VPN Client.
53
+
54
+
1. Select **+** on the bottom left of the page, then select **Import**.
55
+
56
+
1. In the window, navigate to the **azurevpnconfig.xml** file, select it, then select **Open**.
57
+
58
+
1. From the **Certificate Information** dropdown, select the name of the child certificate (the client certificate). For example, **P2SChildCert**. You can also (optionally) select a [Secondary Profile](#secondary-profile).
If you don't see a client certificate in the **Certificate Information** dropdown, you'll need to cancel and fix the issue before proceeding. It's possible that one of the following things is true:
63
+
64
+
* The client certificate isn't installed locally on the client computer.
65
+
* There are multiple certificates with exactly the same name installed on your local computer (common in test environments).
66
+
* The child certificate is corrupt.
67
+
68
+
1. After the import validates (imports with no errors), select **Save**.
69
+
70
+
1. In the left pane, locate the **VPN connection**, then select **Connect**.
71
+
72
+
### Optional settings for the Azure VPN Client
73
+
74
+
The following sections discuss optional configuration settings that are available for the Azure VPN Client.
You can configure the Azure VPN Client with optional configuration settings such as more DNS servers, custom DNS, forced tunneling, custom routes, and other settings. For a description of the available settings and configuration steps, see [Azure VPN Client optional settings](azure-vpn-client-optional-configurations.md).
0 commit comments