Skip to content

Commit 8ed8fbd

Browse files
cherylmccherylmc
committed
update include
1 parent d298ea9 commit 8ed8fbd

File tree

4 files changed

+99
-79
lines changed

4 files changed

+99
-79
lines changed

‎articles/virtual-wan/point-to-site-vpn-client-cert-mac.md

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,52 @@
11
---
2-
title: 'Configure P2S User VPN clients -certificate authentication - macOS and iOS'
3-
titleSuffix: Azure Virtual WAN
4-
description: Learn how to configure the VPN client for Virtual WAN User VPN configurations that use certificate authentication and IKEv2 or OpenVPN tunnel. This article applies to macOS and iOS.
2+
title: 'Configure P2S User VPN native VPN client - certificate authentication - macOS'
3+
description: Learn how to configure the VPN client for Virtual WAN User VPN configurations that use certificate authentication and IKEv2. This article applies to macOS.
54
author: cherylmc
65
ms.service: azure-virtual-wan
76
ms.topic: how-to
8-
ms.date: 04/28/2023
7+
ms.date: 01/30/2025
98
ms.author: cherylmc
109
---
1110

12-
# Configure User VPN P2S clients - certificate authentication - macOS and iOS
11+
# Configure P2S User VPN clients: certificate authentication - native VPN client - macOS
1312

14-
This article helps you connect to Azure Virtual WAN from a macOS or iOS operating system over User VPN P2S for configurations that use Certificate Authentication. To connect from an iOS or macOS operating system over an OpenVPN tunnel, you use an OpenVPN client. To connect from a macOS operating system over an IKEv2 tunnel, you use the VPN client that is natively installed on your Mac.
13+
If your point-to-site (P2S) User VPN gateway is configured to use IKEv2 and certificate authentication, you can connect to your virtual network using the native VPN client that's part of your macOS operating system. This article walks you through the steps to configure the native VPN client and connect to your virtual network.
1514

16-
## Before you begin
15+
## Prerequisites
1716

18-
* Make sure you've completed the necessary configuration steps in the [Tutorial: Create a P2S User VPN connection using Azure Virtual WAN](virtual-wan-point-to-site-portal.md).
17+
This article assumes that you've already performed the following prerequisites:
1918

20-
* **Generate VPN client configuration files:** The VPN client configuration files that you generate are specific to the Virtual WAN User VPN profile that you download. Virtual WAN has two different types of configuration profiles: WAN-level (global), and hub-level. If there are any changes to the P2S VPN configuration after you generate the files, or you change to a different profile type, you need to generate new VPN client configuration files and apply the new configuration to all of the VPN clients that you want to connect. See [Generate User VPN client configuration files](about-vpn-profile-download.md).
19+
* You completed the necessary configuration steps in the [Tutorial: Create a P2S User VPN connection using Azure Virtual WAN](virtual-wan-point-to-site-portal.md).
20+
* You generated and downloaded the VPN client configuration files. The VPN client configuration files that you generate are specific to the Virtual WAN User VPN profile that you download.
2121

22-
* **Obtain certificates:** The sections below require certificates. Make sure you have both the client certificate and the root server certificate information. For more information, see [Generate and export certificates](certificates-point-to-site.md) for more information.
22+
Virtual WAN has two different types of configuration profiles: WAN-level (global), and hub-level. For more information, see [Download global and hub VPN profiles](global-hub-profile.md). If there are any changes to the P2S VPN configuration after you generate the files, or you change to a different profile type, you need to generate new VPN client configuration files and apply the new configuration to all of the VPN clients that you want to connect.
23+
* You have acquired the necessary certificates. You can either [generate client certificates](certificates-point-to-site.md), or acquire the appropriate client certificates necessary for authentication. Make sure you have both the client certificate and the root server certificate information.
2324

24-
## <a name="ikev2-macOS"></a>IKEv2 - native client - macOS steps
25+
### Connection requirements
2526

26-
[!INCLUDE [IKEv2 Native client Mac](../../includes/virtual-wan-certificates-mac-native-client-include.md)]
27+
To connect to Azure using the native VPN client software and certificate authentication, each connecting client requires the following items:
2728

28-
## <a name="openvpn-macOS"></a>OpenVPN Client - macOS steps
29+
* The client must have a client certificate that's installed locally.
30+
* The client must be running a supported version of macOS.
2931

30-
The following example uses **TunnelBlick**.
32+
### Workflow
3133

32-
[!INCLUDE [OpenVPN Mac](../../includes/vpn-gateway-vwan-config-openvpn-mac.md)]
34+
The workflow for this article is as follows:
3335

34-
## <a name="OpenVPN-iOS"></a>OpenVPN Client - iOS steps
36+
1. Generate client certificates if you haven't already done so.
37+
1. View the VPN client profile configuration files contained in the VPN client profile configuration package that you generated.
38+
1. Install certificates.
39+
1. Configure the native VPN client that's already installed your OS.
40+
1. Connect to Azure.
3541

36-
The following example uses **OpenVPN Connect** from the App store.
42+
## Generate certificates
3743

38-
[!INCLUDE [OpenVPN iOS](../../includes/vpn-gateway-vwan-config-openvpn-ios.md)]
44+
For certificate authentication, a client certificate must be installed on each client computer. The client certificate you want to use must be exported with the private key, and must contain all certificates in the certification path. Additionally, for some configurations, you'll also need to install root certificate information.
45+
46+
For information about working with certificates, see [Generate and export certificates](certificates-point-to-site.md).
47+
48+
[!INCLUDE [Configure macOS](../../includes/vpn-gateway-vwan-native-certificate.md)]
3949

4050
## Next steps
4151

42-
[Tutorial: Create a P2S User VPN connection using Azure Virtual WAN](virtual-wan-point-to-site-portal.md).
52+
Follow up with any additional server or connection settings. See [Tutorial: Create a P2S User VPN connection using Azure Virtual WAN](virtual-wan-point-to-site-portal.md).

‎articles/vpn-gateway/point-to-site-vpn-client-cert-mac.md

Lines changed: 3 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Learn how to configure the VPN client for VPN Gateway P2S configura
55
author: cherylmc
66
ms.service: azure-vpn-gateway
77
ms.topic: how-to
8-
ms.date: 10/07/2024
8+
ms.date: 01/30/2025
99
ms.author: cherylmc
1010
---
1111

@@ -26,6 +26,7 @@ This article assumes that you've already performed the following prerequisites:
2626
* You created and configured your VPN gateway for point-to-site certificate authentication and the OpenVPN tunnel type. See [Configure server settings for P2S VPN Gateway connections - certificate authentication](point-to-site-certificate-gateway.md) for steps.
2727
* You generated and downloaded the VPN client configuration files. See [Generate VPN client profile configuration files](point-to-site-certificate-gateway.md#profile-files) for steps.
2828
* You can either generate client certificates, or acquire the appropriate client certificates necessary for authentication.
29+
* Your VPN gateway must be using a SKU other than the **Basic SKU**.
2930

3031
### Workflow
3132

@@ -43,65 +44,7 @@ For certificate authentication, a client certificate must be installed on each c
4344

4445
For information about working with certificates, see [Generate and export certificates](vpn-gateway-certificates-point-to-site.md).
4546

46-
## View the VPN client profile configuration files
47-
48-
All of the necessary configuration settings for the VPN clients are contained in a VPN client profile configuration zip file. You can generate client profile configuration files using PowerShell, or by using the Azure portal. Either method returns the same zip file.
49-
50-
The VPN client profile configuration files are specific to the P2S VPN gateway configuration for the virtual network. If there are any changes to the P2S VPN configuration after you generate the files, such as changes to the VPN protocol type or authentication type, you need to generate new VPN client profile configuration files and apply the new configuration to all of the VPN clients that you want to connect.
51-
52-
Unzip the file to view the folders. When you configure macOS native clients, you use the files in the **Generic** folder. The Generic folder is present if IKEv2 was configured on the gateway. If you don't see the Generic folder, check the following items, then generate the zip file again.
53-
54-
* Check the tunnel type for your configuration. It's likely that IKEv2 wasn’t selected as a tunnel type.
55-
* Verify that the gateway isn't configured with the Basic SKU. The VPN Gateway Basic SKU doesn’t support IKEv2. You'll have to rebuild the gateway with the appropriate SKU and tunnel type if you want macOS clients to connect.
56-
57-
The **Generic** folder contains the following files.
58-
59-
* **VpnSettings.xml**, which contains important settings like server address and tunnel type.
60-
* **VpnServerRoot.cer**, which contains the root certificate required to validate the Azure VPN gateway during P2S connection setup.
61-
62-
## Install certificates
63-
64-
You'll need both the root certificate and the child certificate installed on your Mac. The child certificate must be exported with the private key and must contain all certificates in the certification path.
65-
66-
### Root certificate
67-
68-
1. Copy the root certificate file (the .cer file) - to your Mac. Double-click the certificate. Depending on your operating system, the certificate will either automatically install, or you'll see the **Add Certificates** page.
69-
1. If you see the **Add Certificates** page, for **Keychain:** click the arrows and select **login** from the dropdown.
70-
1. Click **Add** to import the file.
71-
72-
### Client certificate
73-
74-
The client certificate (.pfx file) is used for authentication and is required. Typically, you can just click the client certificate to install. For more information about how to install a client certificate, see [Install a client certificate](point-to-site-how-to-vpn-client-install-azure-cert.md).
75-
76-
### Verify certificates are installed
77-
78-
Verify that both the client and the root certificate are installed.
79-
80-
1. Open **Keychain Access**.
81-
1. Go to the **Certificates** tab.
82-
1. Verify that both the client and the root certificate are installed.
83-
84-
## Configure VPN client profile
85-
86-
Use the steps in the [Mac User Guide](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac) that are appropriate for your operating system version to add a VPN client profile configuration with the following settings.
87-
88-
* Select **IKEv2** as the VPN type.
89-
* For **Display Name**, select a friendly name for the profile.
90-
* For both **Server Address** and **Remote ID**, use the value from the **VpnServer** tag in the **VpnSettings.xml** file.
91-
92-
:::image type="content" source="./media/point-to-site-vpn-client-cert-mac/vpn-server.png" alt-text="Screenshot to click Select." lightbox="./media/point-to-site-vpn-client-cert-mac/vpn-server.png":::
93-
94-
* For **Authentication** settings, select **Certificate**.
95-
* For the **Certificate**, choose the child certificate you want to use for authentication. If you have multiple certificates, you can select **Show Certificate** to see more information about each certificate.
96-
* For **Local ID**, type the name of the child certificate that you selected.
97-
98-
Once you finished configuring the VPN client profile, save the profile.
99-
100-
## Connect
101-
102-
The steps to connect are specific to the macOS operating system version. Refer to the [Mac User Guide](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac). Select the operating system version that you're using and follow the steps to connect.
103-
104-
Once the connection has been established, the status shows as **Connected**. The IP address is allocated from the VPN client address pool.
47+
[!INCLUDE [Configure macOS](../../includes/vpn-gateway-vwan-native-certificate.md)]
10548

10649
## Next steps
10750

‎includes/media/vpn-gateway-vwan-native-certificate.md/vpn-server.png

159 KB
Loading

‎includes/vpn-gateway-vwan-native-certificate.md

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
author: cherylmc
3+
ms.service: azure-vpn-gateway
4+
ms.topic: include
5+
ms.date: 01/30/2025
6+
ms.author: cherylmc
7+
8+
#Customer intent: this file is used for both virtual wan and vpn gateway articles.
9+
---
10+
## View the VPN client profile configuration files
11+
12+
All of the necessary configuration settings for the VPN clients are contained in a VPN client profile configuration zip file. You can generate client profile configuration files using PowerShell, or by using the Azure portal. Either method returns the same zip file.
13+
14+
The VPN client profile configuration files are specific to the P2S VPN gateway configuration for the virtual network. If there are any changes to the P2S VPN configuration after you generate the files, such as changes to the VPN protocol type or authentication type, you need to generate new VPN client profile configuration files and apply the new configuration to all of the VPN clients that you want to connect.
15+
16+
Unzip the file to view the folders. When you configure macOS native clients, you use the files in the **Generic** folder. The Generic folder is present if IKEv2 was configured on the gateway. If you don't see the Generic folder, check the following items, then generate the zip file again.
17+
18+
* Check the tunnel type for your configuration. It's likely that IKEv2 wasn’t selected as a tunnel type.
19+
20+
The **Generic** folder contains the following files.
21+
22+
* **VpnSettings.xml**, which contains important settings like server address and tunnel type.
23+
* **VpnServerRoot.cer**, which contains the root certificate required to validate the Azure VPN gateway during P2S connection setup.
24+
25+
## Install certificates
26+
27+
You'll need both the root certificate and the child certificate installed on your Mac. The child certificate must be exported with the private key and must contain all certificates in the certification path.
28+
29+
### Root certificate
30+
31+
1. Copy the root certificate file (the .cer file) - to your Mac. Double-click the certificate. Depending on your operating system, the certificate will either automatically install, or you'll see the **Add Certificates** page.
32+
1. If you see the **Add Certificates** page, for **Keychain:** click the arrows and select **login** from the dropdown.
33+
1. Click **Add** to import the file.
34+
35+
### Client certificate
36+
37+
The client certificate (.pfx file) is used for authentication and is required. Typically, you can just click the client certificate to install.
38+
39+
### Verify certificates are installed
40+
41+
Verify that both the client and the root certificate are installed.
42+
43+
1. Open **Keychain Access**.
44+
1. Go to the **Certificates** tab.
45+
1. Verify that both the client and the root certificate are installed.
46+
47+
## Configure VPN client profile
48+
49+
Use the steps in the [Mac User Guide](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac) that are appropriate for your operating system version to add a VPN client profile configuration with the following settings.
50+
51+
* Select **IKEv2** as the VPN type.
52+
* For **Display Name**, select a friendly name for the profile.
53+
* For both **Server Address** and **Remote ID**, use the value from the **VpnServer** tag in the **VpnSettings.xml** file.
54+
55+
:::image type="content" source="./media/vpn-gateway-vwan-native-certificate/vpn-server.png" alt-text="Screenshot to click Select." lightbox="./media/vpn-gateway-vwan-native-certificate/vpn-server.png":::
56+
57+
* For **Authentication** settings, select **Certificate**.
58+
* For the **Certificate**, choose the child certificate you want to use for authentication. If you have multiple certificates, you can select **Show Certificate** to see more information about each certificate.
59+
* For **Local ID**, type the name of the child certificate that you selected.
60+
61+
Once you finished configuring the VPN client profile, save the profile.
62+
63+
## Connect
64+
65+
The steps to connect are specific to the macOS operating system version. Refer to the [Mac User Guide](https://support.apple.com/guide/mac-help/set-up-a-vpn-connection-on-mac-mchlp2963/mac). Select the operating system version that you're using and follow the steps to connect.
66+
67+
Once the connection has been established, the status shows as **Connected**. The IP address is allocated from the VPN client address pool.

0 commit comments

Comments
 (0)