Skip to content

Commit a3afa65

Browse files
denreadenrea
authored
Merge pull request #296038 from cherylmc/p2s-update
format
2 parents f966be2 + a4af833 commit a3afa65

11 files changed

+110
-55
lines changed

‎articles/vpn-gateway/point-to-site-certificate-gateway.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@ description: Learn how to configure VPN Gateway server settings for point-to-sit
55
author: cherylmc
66
ms.service: azure-vpn-gateway
77
ms.topic: how-to
8-
ms.date: 11/07/2024
8+
ms.date: 03/10/2025
99
ms.author: cherylmc
1010
---
1111
# Configure server settings for P2S VPN Gateway certificate authentication
1212

13-
This article helps you configure the necessary VPN Gateway point-to-site (P2S) server settings to let you securely connect individual clients running Windows, Linux, or macOS to an Azure virtual network (VNet). P2S VPN connections are useful when you want to connect to your virtual network from a remote location, such as when you're telecommuting from home or a conference. You can also use P2S instead of a site-to-site (S2S) VPN when you have only a few clients that need to connect to a virtual network.
13+
This article helps you configure the necessary VPN Gateway point-to-site (P2S) server settings to let you securely connect from individual client computers running Windows, Linux, or macOS to an Azure virtual network (VNet). P2S VPN connections are useful when you want to connect to your virtual network from a remote location, such as when you're telecommuting from home or a conference. You can also use P2S instead of a site-to-site (S2S) VPN when you have only a few clients that need to connect to a virtual network.
1414

1515
P2S connections don't require a VPN device or a public-facing IP address. There are various different configuration options available for P2S. For more information about point-to-site VPN, see [About point-to-site VPN](point-to-site-about.md).
1616

@@ -22,12 +22,11 @@ The steps in this article use the Azure portal to configure your Azure VPN gatew
2222

2323
## Prerequisites
2424

25-
This article assumes the following prerequisites:
25+
This article assumes that you have already created a route-based VPN gateway that's compatible with the P2S configuration that you want to create, the authentication method that you want to use, and the connecting VPN clients.
2626

27-
* An Azure virtual network.
28-
* A route-based VPN gateway that's compatible with the P2S configuration that you want to create and the connecting VPN clients. To help determine the P2S configuration that you need, see the [VPN client table](#type). If your gateway uses the Basic SKU, understand that the Basic SKU has P2S limitations and doesn't support IKEv2 or RADIUS authentication. For more information, see [About gateway SKUs](about-gateway-skus.md).
29-
30-
If you don't yet have a functioning VPN gateway that's compatible with the P2S configuration that you want to create, see [Create and manage a VPN gateway](tutorial-create-gateway-portal.md). Create a compatible VPN gateway, then return to this article to configure P2S settings.
27+
* If you don't yet have a VPN gateway, see [Create and manage a VPN gateway](tutorial-create-gateway-portal.md), then return to this page to configure the point-to-site VPN gateway settings.
28+
* To help determine the P2S configuration that you need, see the [VPN client table](#type).
29+
* If you have a VPN gateway that uses the Basic SKU, understand that the Basic SKU has P2S limitations and doesn't support IKEv2 or RADIUS authentication. For more information, see [About gateway SKUs](about-gateway-skus.md).
3130

3231
## <a name="generatecert"></a>Generate certificates
3332

‎articles/vpn-gateway/tutorial-create-gateway-portal.md

Lines changed: 14 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: cherylmc
66
ms.author: cherylmc
77
ms.service: azure-vpn-gateway
88
ms.topic: tutorial
9-
ms.date: 11/20/2024
9+
ms.date: 03/10/2025
1010

1111
---
1212

@@ -18,6 +18,7 @@ This tutorial helps you create and manage a virtual network gateway (VPN gateway
1818

1919
* The left side of the diagram shows the virtual network and the VPN gateway that you create by using the steps in this article.
2020
* You can later add different types of connections, as shown on the right side of the diagram. For example, you can create [site-to-site](tutorial-site-to-site-portal.md) and [point-to-site](point-to-site-about.md) connections. To view different design architectures that you can build, see [VPN gateway design](design.md).
21+
* For more information about Azure VPN Gateway, see [What is Azure VPN Gateway](vpn-gateway-about-vpngateways.md)? If you want to learn more about the configuration settings used in this tutorial, see [About VPN Gateway configuration settings](vpn-gateway-about-vpn-gateway-settings.md).
2122

2223
In this tutorial, you learn how to:
2324

@@ -28,12 +29,6 @@ In this tutorial, you learn how to:
2829
> * Resize a VPN gateway (resize SKU).
2930
> * Reset a VPN gateway.
3031
31-
* If you want to learn more about the configuration settings used in this tutorial, see [About VPN Gateway configuration settings](vpn-gateway-about-vpn-gateway-settings.md).
32-
* For more information about Azure VPN Gateway, see [What is Azure VPN Gateway](vpn-gateway-about-vpngateways.md).
33-
* If you want to create a gateway using the Basic SKU (instead of VpnGw2AZ), see [Create a Basic SKU VPN gateway](create-gateway-basic-sku-powershell.md).
34-
* For more information about active-active mode gateways, see [About active-active mode](about-active-active-gateways.md).
35-
* For more information about zone-redundant gateways, see [About zone-redundant gateways](about-zone-redundant-vnet-gateways.md).
36-
3732
> [!NOTE]
3833
> [!INCLUDE [AZ SKU region support note](../../includes/vpn-gateway-az-regions-support-include.md)]
3934
@@ -43,18 +38,11 @@ You need an Azure account with an active subscription. If you don't have one, [c
4338

4439
## <a name="CreateVNet"></a>Create a virtual network
4540

46-
Create a virtual network using the following example values:
47-
48-
* **Resource group:** TestRG1
49-
* **Name:** VNet1
50-
* **Region:** (US) East US (or region of your choosing)
51-
* **IPv4 address space:** 10.1.0.0/16
52-
* **Subnet name:** Use the default name, or specify a name. Example: FrontEnd
53-
* **Subnet address space:** 10.1.0.0/24
41+
This article uses the Azure portal to create a virtual network. You can also use a different tool or method to create a virtual network. For more information or steps, see [Create a virtual network](../virtual-network/quick-create-portal.md). For this exercise, the virtual network doesn't require the configuration of additional services, such as [Azure Bastion](../bastion/bastion-overview.md) or [DDoS Protection](../ddos-protection/ddos-protection-overview.md). However, you can add these services if you want to use them.
5442

55-
[!INCLUDE [Create a VNet](../../includes/vpn-gateway-basic-vnet-rm-portal-include.md)]
43+
[!INCLUDE [Virtual network values](../../includes/vpn-gateway-virtual-network-values.md)]
5644

57-
After you create your virtual network, you can optionally configure Azure DDoS Protection. Protection is simple to enable on any new or existing virtual network, and it requires no application or resource changes. For more information about Azure DDoS Protection, see [What is Azure DDoS Protection](../ddos-protection/ddos-protection-overview.md).
45+
[!INCLUDE [Create a VNet](../../includes/vpn-gateway-virtual-network-steps.md)]
5846

5947
## Create a gateway subnet
6048

@@ -66,40 +54,24 @@ After you create your virtual network, you can optionally configure Azure DDoS P
6654

6755
## <a name="VNetGateway"></a>Create a VPN gateway
6856

69-
In this section, you create the virtual network gateway (VPN gateway) for your virtual network. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU.
70-
71-
Create a gateway using the following values:
72-
73-
* **Name**: VNet1GW
74-
* **Gateway type**: VPN
75-
* **SKU**: VpnGw2AZ
76-
* **Generation**: Generation 2
77-
* **Virtual network**: VNet1
78-
* **Gateway subnet address range**: 10.1.255.0/27
79-
* **Public IP address**: Create new
80-
* **Public IP address name:** VNet1GWpip1
81-
* **Public IP address SKU:** Standard
82-
* **Assignment:** Static
83-
* **Second Public IP address name:** VNet1GWpip2
57+
In this section, you create the virtual network gateway (VPN gateway) for your virtual network. Creating a gateway can often take 45 minutes or more, depending on the selected gateway SKU. Use the following steps to create a VPN gateway. Note that the VPN Gateway Basic SKU is only available in [PowerShell](create-gateway-basic-sku-powershell.md) or CLI.
8458

85-
[!INCLUDE [Create a vpn gateway](../../includes/vpn-gateway-add-azgw-portal-include.md)]
86-
[!INCLUDE [Configure PIP settings](../../includes/vpn-gateway-add-azgw-pip-portal-include.md)]
59+
[!INCLUDE [Create a vpn gateway](../../includes/vpn-gateway-add-gateway-portal.md)]
60+
[!INCLUDE [Configure PIP settings](../../includes/vpn-gateway-add-gw-pip-portal.md)]
8761

88-
A gateway can take 45 minutes or more to fully create and deploy. You can see the deployment status on the **Overview** page for your gateway. After the gateway is created, you can view the IP address assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device.
62+
You can see the deployment status on the **Overview** page for your gateway. Once the gateway is created, you can view the IP address assigned to it by looking at the virtual network in the portal. The gateway appears as a connected device.
8963

9064
## <a name="view"></a>View public IP address
9165

9266
To view public IP addresses associated to your virtual network gateway, navigate to your gateway in the portal.
9367

94-
1. On the portal page for your virtual network gateway, under **Settings**, open the **Properties** page.
68+
1. On the **Virtual network gateway** portal page, under **Settings**, open the **Properties** page.
9569
1. To view more information about the IP address object, click the associated IP address link.
9670

9771
## <a name="resize"></a>Resize a gateway SKU
9872

9973
There are specific rules for resizing versus changing a gateway SKU. In this section, you resize the SKU. For more information, see [Resize or change gateway SKUs](about-gateway-skus.md#resizechange).
10074

101-
The basic steps are:
102-
10375
1. Go to the **Configuration** page for your virtual network gateway.
10476
1. On the right side of the page, select the dropdown arrow to show a list of available SKUs. Notice that the list only populates SKUs that you're able to use to resize your current SKU. If you don't see the SKU you want to use, instead of resizing, you have to change to a new SKU.
10577
1. Select the SKU from the dropdown list and save your changes.
@@ -108,8 +80,6 @@ The basic steps are:
10880

10981
Gateway resets behave differently, depending on your gateway configuration. For more information, see [Reset a VPN gateway or a connection](reset-gateway.md).
11082

111-
The basic steps are:
112-
11383
[!INCLUDE [reset a gateway](../../includes/vpn-gateway-reset-gw-portal-include.md)]
11484

11585
## Clean up resources
@@ -129,4 +99,7 @@ After you create a VPN gateway, you can configure more gateway settings and conn
12999
> [Site-to-site VPN connections](./tutorial-site-to-site-portal.md)
130100
131101
> [!div class="nextstepaction"]
132-
> [Point-to-site VPN connections](point-to-site-certificate-gateway.md)
102+
> [Point-to-site - Certificate authentication VPN connections](point-to-site-certificate-gateway.md)
103+
104+
> [!div class="nextstepaction"]
105+
> [Point-to-site - Microsoft Entra ID authentication VPN connections](point-to-site-entra-gateway.md)

‎includes/media/vpn-gateway-add-gateway-portal/vpn-gateway-portal.png

142 KB
Loading

‎includes/vpn-gateway-about-gwsubnet-include.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
ms.topic: include
33
author: cherylmc
44
ms.service: azure-vpn-gateway
5-
ms.date: 11/18/2024
5+
ms.date: 03/10/2025
66
ms.author: cherylmc
77
---
88

‎includes/vpn-gateway-add-gateway-portal.md

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
author: cherylmc
3+
ms.service: azure-vpn-gateway
4+
ms.topic: include
5+
ms.date: 03/12/2025
6+
ms.author: cherylmc
7+
8+
# The numbers in this include are correct. They add on to sections in multiple articles that are already numbered. Please do not change the numbers in any way.
9+
---
10+
11+
12+
1. In **Search resources, services, and docs (G+/)**, enter **virtual network gateway**. Locate **Virtual network gateway** in the **Marketplace** search results and select it to open the **Create virtual network gateway** page.
13+
14+
:::image type="content" source="./media/vpn-gateway-add-gateway-portal/vpn-gateway-portal.png" alt-text="Screenshot that shows the Instance fields." lightbox="./media/vpn-gateway-add-gateway-portal/vpn-gateway-portal.png":::
15+
16+
2. On the **Basics** tab, fill in the values for **Project details** and **Instance details**.
17+
18+
| Setting | Value |
19+
|---|---|
20+
| Name | Example: VNet1GW |
21+
| Region | The region for the gateway must be the same as the virtual network. |
22+
| Gateway type | Select **VPN**. VPN gateways use the virtual network gateway type **VPN**. |
23+
| SKU | Example: VpnGw2AZ. We recommend that you select a [Gateway SKU](../articles/vpn-gateway/about-gateway-skus.md) that ends in AZ if your region supports [availability zones](../articles/vpn-gateway/about-zone-redundant-vnet-gateways.md).|
24+
| Generation | **Generation 2** |
25+
| Virtual network | Example: VNet1. If your virtual network isn't available in the dropdown, you need to adjust the region you selected. |
26+
| Subnet | Example: 10.1.255.0/27, A subnet named **GatewaySubnet** is required to create a VPN gateway. If the gateway subnet doesn't autopopulate, *and* you don't see the option to create one on this page, go back to your virtual network page and create the gateway subnet.|

‎includes/vpn-gateway-add-gw-pip-portal.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
author: cherylmc
3+
ms.service: azure-vpn-gateway
4+
ms.topic: include
5+
ms.date: 03/10/2025
6+
ms.author: cherylmc
7+
8+
# The numbers in this include are correct. They add on to sections in multiple articles that are already numbered.
9+
---
10+
3. Specify the values for **Public IP address**. These settings specify the public IP address object that gets associated to the VPN gateway. The public IP address is assigned to this object when the VPN gateway is created. The only time the primary public IP address changes is when the gateway is deleted and re-created.
11+
12+
| Setting | Value |
13+
| --- | --- |
14+
| Public IP address name | Example: VNet1GWpip1 |
15+
| Availability zone | This setting is available for AZ SKUs in regions that support [availability zones](../articles/vpn-gateway/about-zone-redundant-vnet-gateways.md). Example: **Zone-redundant**. |
16+
| Enable active-active mode | - Select **Enabled** to take advantage of the benefits of an [active-active gateway](../articles/vpn-gateway/about-active-active-gateways.md). An active-active gateway requires an additional public IP address.<br>- If you plan to use this gateway for site-to-site connections, verify the [active-active design](../articles/vpn-gateway/about-active-active-gateways.md#active-active-mode-design) that you want to use.<br>- Connections with your on-premises VPN device must be configured specifically to take advantage of active-active mode.<br>- Some VPN devices don't support active-active mode. If you're not sure, check with your VPN device vendor. If you're using a VPN device that doesn't support active-active mode, you can select **Disabled** for this setting. |
17+
| Second public IP address name | Only available for active-active mode gateways. Example: VNet1GWpip2 |
18+
| Availability zone | Example: **Zone-redundant**. |
19+
| Configure BGP | Select **Disabled**, unless your configuration specifically requires this setting. If you do require this setting, the default ASN is 65515.|
20+
| Enable Key Vault Access | Select **Disabled** unless you have a specific requirement to enable this setting. |
21+
22+
4. Select **Review + create** to run validation.
23+
5. After validation passes, select **Create** to deploy the VPN gateway.

‎includes/vpn-gateway-create-gateway-subnet-portal-include.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@
22
author: cherylmc
33
ms.service: azure-vpn-gateway
44
ms.topic: include
5-
ms.date: 01/17/2024
5+
ms.date: 03/10/2025
66
ms.author: cherylmc
77
---
88

99
1. On the page for your virtual network, on the left pane, select **Subnets** to open the **Subnets** page.
10-
1. At the top of the page, select **+ Gateway subnet** to open the **Add subnet** pane.
11-
1. The name is automatically entered as **GatewaySubnet**. Adjust the IP address range value, if necessary. An example is **10.1.255.0/27**.
12-
1. Don't adjust the other values on the page. Select **Save** at the bottom of the page to save the subnet.
10+
1. At the top of the page, select **+ Subnet** to open the **Add subnet** pane.
11+
1. For **Subnet purpose**, select **Virtual Network Gateway** from the dropdown.
12+
1. The name is automatically entered as **GatewaySubnet**. Adjust starting IP address and size if necessary. For example, **10.1.255.0/27**.
13+
1. Don't adjust the other values on the page. Click **Add** to add the subnet.

‎includes/vpn-gateway-no-nsg-include.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
author: cherylmc
33
ms.service: azure-vpn-gateway
44
ms.topic: include
5-
ms.date: 06/24/2024
5+
ms.date: 03/10/2025
66
ms.author: cherylmc
77
---
88
> [!IMPORTANT]

‎includes/vpn-gateway-reset-gw-portal-include.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
author: cherylmc
33
ms.service: azure-vpn-gateway
44
ms.topic: include
5-
ms.date: 06/25/2024
5+
ms.date: 03/10/2025
66
ms.author: cherylmc
77
---
88

‎includes/vpn-gateway-virtual-network-steps.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
author: cherylmc
3+
ms.author: cherylmc
4+
ms.service: azure-vpn-gateway
5+
ms.topic: include
6+
ms.date: 03/10/2025
7+
---
8+
9+
1. Sign in to the Azure portal.
10+
1. In **Search resources, service, and docs (G+/)** at the top of the portal page, enter **virtual network**. Select **Virtual network** from the **Marketplace** search results to open the **Virtual network** page.
11+
1. On the **Virtual network** page, select **Create** to open the **Create virtual network** page.
12+
1. Fill out the required values for the **Basics** tab.
13+
1. Select **Next** or **Security** to go to the **Security** tab. For this exercise, leave the default values for all the services on this page.
14+
1. Select **IP Addresses** to go to the **IP Addresses** tab. On the **IP Addresses** tab, configure the required settings.
15+
1. Review the **IP addresses** page and remove any address spaces or subnets that you don't need.
16+
1. Select **Review + create** to validate the virtual network settings.
17+
1. After the settings are validated, select **Create** to create the virtual network.

0 commit comments

Comments
 (0)