Skip to content

Commit e214547

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #246888 from cherylmc/vwanmulti
format article
2 parents c0c1161 + 0ea0c93 commit e214547

File tree

5 files changed

+97
-81
lines changed

5 files changed

+97
-81
lines changed

‎articles/virtual-wan/user-groups-about.md‎

Lines changed: 7 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Learn about using user groups to assign IP addresses from specific
55
author: cherylmc
66
ms.service: virtual-wan
77
ms.topic: conceptual
8-
ms.date: 05/29/2023
8+
ms.date: 07/31/2023
99
ms.author: cherylmc
1010

1111
---
@@ -25,79 +25,7 @@ This article covers the following concepts:
2525
* Configuration requirements and limitations
2626
* Use cases
2727

28-
## Server configuration concepts
29-
30-
The following sections explain the common terms and values used for server configuration.
31-
32-
### User Groups (policy groups)
33-
34-
A **User Group** or policy group is a logical representation of a group of users that should be assigned IP addresses from the same address pool.
35-
36-
### Group members (policy members)
37-
38-
User groups consist of members. Members don't correspond to individual users but rather define the criteria used to determine which group a connecting user is a part of. A single group can have multiple members. If a connecting user matches the criteria specified for one of the group's members, the user is considered to be part of that group and can be assigned an appropriate IP address.
39-
The types of member parameters that are available depend on the authentication methods specified in the VPN server configuration. For a full list of available criteria, see the [Available group settings](#available-group-settings) section of this article.
40-
41-
### Default user/policy group
42-
43-
For every P2S VPN server configuration, one group must be selected as default. Users who present credentials that don't match any group settings are considered to be part of the default group. Once a group is created, the default setting of that group can't be changed.
44-
45-
### Group priority
46-
47-
Each group is also assigned a numerical priority. Groups with lower priority are evaluated first. This means that if a user presents credentials that match the settings of multiple groups, they're considered part of the group with the lowest priority. For example, if user A presents a credential that corresponds to the IT Group (priority 3) and Finance Group (priority 4), user A is considered part of the IT Group for purposes of assigning IP addresses.
48-
49-
### Available group settings
50-
51-
The following section describes the different parameters that can be used to define which groups members are a part of. The available parameters vary based on selected authentication methods.
52-
The following table summarizes the available setting types and acceptable values. For more detailed information on each type of Member Value, view the section corresponding to your authentication type.
53-
54-
|Authentication type|Member type |Member values|Example member value|
55-
|---|---|---|---|
56-
Azure Active Directory|AADGroupID|Azure Active Directory Group Object ID |0cf484f2-238e-440b-8c73-7bf232b248dc|
57-
|RADIUS|AzureRADIUSGroupID|Vendor-specific Attribute Value (hexadecimal) (must begin with 6ad1bd)|6ad1bd23|
58-
|Certificate|AzureCertificateID|Certificate Common Name domain name (CN=user@red.com)|red|
59-
60-
#### Azure Active Directory authentication (OpenVPN only)
61-
62-
Gateways using Azure Active Directory authentication can use **Azure Active Directory Group Object IDs** to determine which user group a user belongs to. If a user is part of multiple Azure Active Directory groups, they're considered to be part of the Virtual WAN user group that has the lowest numerical priority.
63-
64-
However, if you plan to have users who are external (users who aren't part of the Azure Active Directory domain configured on the VPN gateway) connect to the Virtual WAN Point-to-site VPN gateway, make sure that the user type of the external user is "Member" and **not** "Guest". Also, make sure that the "Name" of the user is set to the user's email address. If the user type and name of the connecting user isn't set correctly as described above or you can't set an external member to be a "Member" of your Azure Active Directory domain, that connecting user will be assigned to the default group and assigned an IP from the default IP address pool.
65-
66-
You can also identify whether or not a user is external by looking at the user's "User Principal Name." External users have **#EXT** in their "User Principal Name."
67-
68-
:::image type="content" source="./media/user-groups-about/groups.png" alt-text="Screenshot of an Azure Active Directory group." lightbox="./media/user-groups-about/groups.png":::
69-
70-
#### Azure Certificate (OpenVPN and IKEv2)
71-
72-
Gateways that use Certificate-based authentication use the **domain name** of user certificate Common Names (CN) to determine which group a connecting user is in. Common Names must be in one of the following formats:
73-
74-
* domain/username
75-
* username@domain.com
76-
77-
Make sure that the **domain** is the input as a group member.
78-
79-
#### RADIUS server (OpenVPN and IKEv2)
80-
81-
Gateways that use RADIUS-based authentication use a new **Vendor-Specific Attribute (VSA)** to determine VPN user groups.
82-
When RADIUS-based authentication is configured on the P2S gateway, the gateway serves as a Network Policy Server (NPS) proxy. This means that the P2S VPN gateway serves as a client to authenticate users with your RADIUS server using the RADIUS protocol.
83-
84-
After your RADIUS server has successfully verified the user's credentials, the RADIUS server can be configured to send a new Vendor-Specific Attribute (VSA) as part of Access-Accept packets. The P2S VPN gateway processes the VSA in the Access-Accept packets and assigns specific IP addresses to users based on the value of the VSAs.
85-
86-
Therefore, RADIUS servers should be configured to send a VSA with the same value for all users that are part of the same group.
87-
88-
>[!NOTE]
89-
> The value of the VSA must be an octet hexadecimal string on the RADIUS server and the Azure. This octet string must begin with **6ad1bd**. The last two hexadecimal digits may be configured freely. For example, 6ad1bd98 is valid but 6ad12323 and 6a1bd2 would not be valid.
90-
>
91-
92-
The new VSA is **MS-Azure-Policy-ID**.
93-
94-
The MS-Azure-Policy-ID VSA is used by the RADIUS server to send an identifier that is used by P2S VPN server to match an authenticated RADIUS user policy configured on Azure side. This policy is used to select the IP/ Routing configuration (assigned IP address) for the user.
95-
96-
The fields of MS-Azure-Policy-ID MUST be set as follows:
97-
98-
* **Vendor-Type:** An 8-bit unsigned integer that MUST be set to 0x41 (integer: 65).
99-
* **Vendor-Length:** An 8-bit unsigned integer that MUST be set to the length of the octet string in the Attribute-Specific Value plus 2.
100-
* **Attribute-Specific Value:** An octet string containing Policy ID configured on Azure Point to Site VPN server.
28+
[!INCLUDE [User groups configuration all](../../includes/virtual-wan-user-groups.md)]
10129

10230
For configuration information, see [RADIUS - configure NPS for vendor-specific attributes](user-groups-radius.md).
10331

@@ -134,9 +62,13 @@ This section lists configuration requirements and limitations for user groups an
13462

13563
[!INCLUDE [User groups configuration considerations](../../includes/virtual-wan-user-groups-considerations.md)]
13664

65+
* Address pools can't overlap with address pools used in other connection configurations (same or different gateways) in the same virtual WAN.
66+
67+
* Address pools also can't overlap with virtual network address spaces, virtual hub address spaces, or on-premises addresses.
68+
13769
## Use cases
13870

139-
Contoso corporation is composed of multiple functional departments, such as Finance, Human Resources and Engineering. Contoso uses Virtual WAN to allow remote workers (users) to connect to Azure Virtual WAN and access resources hosted on-premises or in a Virtual Network connected to the Virtual WAN hub.
71+
Contoso corporation is composed of multiple functional departments, such as Finance, Human Resources and Engineering. Contoso uses Azure Virtual WAN to allow remote workers (users) to connect to the virtual WAN and access resources hosted on-premises or in a virtual network connected to the virtual WAN hub.
14072

14173
However, Contoso has internal security policies where users from the Finance department can only access certain databases and virtual machines, and users from Human Resources have access to other sensitive applications.
14274

‎articles/virtual-wan/user-groups-create.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ description: Learn how to configure user groups and assign IP addresses from spe
55
author: cherylmc
66
ms.service: virtual-wan
77
ms.topic: how-to
8-
ms.date: 05/29/2023
8+
ms.date: 07/31/2023
99
ms.author: cherylmc
1010

1111
---
@@ -35,6 +35,10 @@ This section lists configuration requirements and limitations for user groups an
3535

3636
[!INCLUDE [User groups configuration considerations](../../includes/virtual-wan-user-groups-considerations.md)]
3737

38+
* Address pools can't overlap with address pools used in other connection configurations (same or different gateways) in the same virtual WAN.
39+
40+
* Address pools also can't overlap with virtual network address spaces, virtual hub address spaces, or on-premises addresses.
41+
3842
## Step 2: Choosing authentication mechanism
3943

4044
The following sections list available authentication mechanisms that can be used while creating user groups.

‎includes/media/virtual-wan-user-groups-about/groups.png‎

244 KB
Loading

‎includes/virtual-wan-user-groups-considerations.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
22
author: cherylmc
33
ms.author: cherylmc
4-
ms.date: 05/29/2023
4+
ms.date: 07/31/2023
55
ms.service: virtual-wan
66
ms.topic: include
77
---
88

9-
* The maximum number of groups that can be referenced by a single P2S VPN gateway is 90. The maximum number of policy/group members (criteria used to identify which group a connecting user is a part of) in groups assigned to a gateway is 390. However, if a group is assigned to multiple connection configurations on the same gateway, this group and its members are counted multiple times towards the limits. For example, if there's a policy group with 10 members that is assigned to three VPN connection configurations on the gateway. This configuration would count as three groups with 30 total members as opposed to one group with 10 members. The total number of concurrent users connecting to a gateway is limited by the gateway scale unit and the number of IP
10-
addresses allocated to each user group and not the number of policy/group members associated with a gateway.
9+
* The maximum number of groups that can be referenced by a single P2S VPN gateway is 90. The maximum number of policy/group members (criteria used to identify which group a connecting user is a part of) in groups assigned to a gateway is 390. However, if a group is assigned to multiple connection configurations on the same gateway, this group and its members are counted multiple times towards the limits. For example, if there's a policy group with 10 members that is assigned to three VPN connection configurations on the gateway. This configuration would count as three groups with 30 total members as opposed to one group with 10 members. The total number of concurrent users connecting to a gateway is limited by the gateway scale unit and the number of IP addresses allocated to each user group and not the number of policy/group members associated with a gateway.
1110

1211
* Once a group has been created as part of a VPN server configuration, the name and default setting of a group can't be modified.
1312

@@ -18,5 +17,3 @@ addresses allocated to each user group and not the number of policy/group member
1817
* Groups that are being used by existing point-to-site VPN gateways can't be deleted.
1918

2019
* You can reorder the priorities of your groups by clicking on the up-down arrow buttons corresponding to that group.
21-
22-
* Address pools can't overlap with address pools used in other connection configurations (same or different gateways) in the same virtual WAN. Address pools also can't overlap with virtual network address spaces, virtual hub address spaces, or on-premises addresses

‎includes/virtual-wan-user-groups.md‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
author: cherylmc
3+
ms.author: cherylmc
4+
ms.date: 07/31/2023
5+
ms.service: virtual-wan
6+
ms.topic: include
7+
8+
#This article is used for both Virtual WAN and VPN Gateway. Any updates to the article must work for both of these services. Otherwise, update the VWAN or VPNGW article directly.
9+
---
10+
11+
## Server configuration concepts
12+
13+
The following sections explain the common terms and values used for server configuration.
14+
15+
### User Groups (policy groups)
16+
17+
A **User Group** or policy group is a logical representation of a group of users that should be assigned IP addresses from the same address pool.
18+
19+
### Group members (policy members)
20+
21+
User groups consist of members. Members don't correspond to individual users but rather define the criteria used to determine which group a connecting user is a part of. A single group can have multiple members. If a connecting user matches the criteria specified for one of the group's members, the user is considered to be part of that group and can be assigned an appropriate IP address.
22+
The types of member parameters that are available depend on the authentication methods specified in the VPN server configuration. For a full list of available criteria, see the [Available group settings](#available-group-settings) section of this article.
23+
24+
### Default user/policy group
25+
26+
For every P2S VPN server configuration, one group must be selected as default. Users who present credentials that don't match any group settings are considered to be part of the default group. Once a group is created, the default setting of that group can't be changed.
27+
28+
### Group priority
29+
30+
Each group is also assigned a numerical priority. Groups with lower priority are evaluated first. This means that if a user presents credentials that match the settings of multiple groups, they're considered part of the group with the lowest priority. For example, if user A presents a credential that corresponds to the IT Group (priority 3) and Finance Group (priority 4), user A is considered part of the IT Group for purposes of assigning IP addresses.
31+
32+
### Available group settings
33+
34+
The following section describes the different parameters that can be used to define which groups members are a part of. The available parameters vary based on selected authentication methods.
35+
The following table summarizes the available setting types and acceptable values. For more detailed information on each type of Member Value, view the section corresponding to your authentication type.
36+
37+
|Authentication type|Member type |Member values|Example member value|
38+
|---|---|---|---|
39+
Azure Active Directory|AADGroupID|Azure Active Directory Group Object ID |0cf484f2-238e-440b-8c73-7bf232b248dc|
40+
|RADIUS|AzureRADIUSGroupID|Vendor-specific Attribute Value (hexadecimal) (must begin with 6ad1bd)|6ad1bd23|
41+
|Certificate|AzureCertificateID|Certificate Common Name domain name (CN=user@red.com)|red|
42+
43+
#### Azure Active Directory authentication (OpenVPN only)
44+
45+
Gateways using Azure Active Directory authentication can use **Azure Active Directory Group Object IDs** to determine which user group a user belongs to. If a user is part of multiple Azure Active Directory groups, they're considered to be part of the P2S VPN user group that has the lowest numerical priority.
46+
47+
However, if you plan to have users who are external (users who aren't part of the Azure Active Directory domain configured on the VPN gateway) connect to the point-to-site VPN gateway, make sure that the user type of the external user is "Member" and **not** "Guest". Also, make sure that the "Name" of the user is set to the user's email address. If the user type and name of the connecting user isn't set correctly as described above or you can't set an external member to be a "Member" of your Azure Active Directory domain, that connecting user will be assigned to the default group and assigned an IP from the default IP address pool.
48+
49+
You can also identify whether or not a user is external by looking at the user's "User Principal Name." External users have **#EXT** in their "User Principal Name."
50+
51+
:::image type="content" source="./media/virtual-wan-user-groups-about/groups.png" alt-text="Screenshot of an Azure Active Directory group." lightbox="./media/virtual-wan-user-groups-about/groups.png":::
52+
53+
#### Azure Certificate (OpenVPN and IKEv2)
54+
55+
Gateways that use Certificate-based authentication use the **domain name** of user certificate Common Names (CN) to determine which group a connecting user is in. Common Names must be in one of the following formats:
56+
57+
* domain/username
58+
* username@domain.com
59+
60+
Make sure that the **domain** is the input as a group member.
61+
62+
#### RADIUS server (OpenVPN and IKEv2)
63+
64+
Gateways that use RADIUS-based authentication use a new **Vendor-Specific Attribute (VSA)** to determine VPN user groups.
65+
When RADIUS-based authentication is configured on the P2S gateway, the gateway serves as a Network Policy Server (NPS) proxy. This means that the P2S VPN gateway serves as a client to authenticate users with your RADIUS server using the RADIUS protocol.
66+
67+
After your RADIUS server has successfully verified the user's credentials, the RADIUS server can be configured to send a new Vendor-Specific Attribute (VSA) as part of Access-Accept packets. The P2S VPN gateway processes the VSA in the Access-Accept packets and assigns specific IP addresses to users based on the value of the VSAs.
68+
69+
Therefore, RADIUS servers should be configured to send a VSA with the same value for all users that are part of the same group.
70+
71+
> [!NOTE]
72+
> The value of the VSA must be an octet hexadecimal string on the RADIUS server and the Azure. This octet string must begin with **6ad1bd**. The last two hexadecimal digits may be configured freely. For example, 6ad1bd98 is valid but 6ad12323 and 6a1bd2 would not be valid.
73+
>
74+
75+
The new VSA is **MS-Azure-Policy-ID**.
76+
77+
The MS-Azure-Policy-ID VSA is used by the RADIUS server to send an identifier that is used by P2S VPN server to match an authenticated RADIUS user policy configured on Azure side. This policy is used to select the IP/ Routing configuration (assigned IP address) for the user.
78+
79+
The fields of MS-Azure-Policy-ID MUST be set as follows:
80+
81+
* **Vendor-Type:** An 8-bit unsigned integer that MUST be set to 0x41 (integer: 65).
82+
* **Vendor-Length:** An 8-bit unsigned integer that MUST be set to the length of the octet string in the Attribute-Specific Value plus 2.
83+
* **Attribute-Specific Value:** An octet string containing Policy ID configured on Azure point-to-site VPN server.

0 commit comments

Comments
 (0)