Why do I mention radius just out of the blue?
I'm putting radius in a particular context here,
specifically combining it with the Azure point‑to‑site VPN.
Now, first of all,
remember that a virtual private network is a secure
tunnel over an unsecure medium, and that unsecure medium is the internet.
Assuming you have at least one virtual network in the Azure cloud,
you may be thinking of what is a good way for me to support remote
access into that virtual network that is secure.
In other words, how can we do a VPN?
Well, yes, there is the site‑to‑site VPN,
that would be an always‑on connection between your
on‑premises network and your virtual network,
but there is also the point‑to‑site,
and this is a capability of the Azure virtual
network gateway that supports many,
depends on what sku or stock keeping unit you're paying for on your gateway,
different skus have different maximum numbers of P2S tunnels,
but the value proposition with P2S is that you can give
individual users the ability to create a tunnel into the
virtual network from wherever they are.
This is particularly relevant with the COVID‑19 pandemic in the remote
workforce to where users may not be reporting to your corpnet where you've got
a site‑to‑site VPN or an ExpressRoute tunnel into Azure,
you see.
How can we give remote users who just have an internet
connection the ability to stand up a secure tunnel?
Well, that's what P2S is, and the protocol selection here is variable.
You can use the secure sockets tunneling protocol on TCP 443.
This is a semi‑proprietary VPN protocol,
however, it's proprietary to Windows, number one,
so if you've got users who are running Linux and macOS,
you'll want to go another route.
We can use the internet key exchange V2 protocol,
IKEv2, to support Mac clients, but even better nowadays,
in Azure, we have the OpenVPN protocol,
which will allow your users to do a point‑to‑site VPN from Windows,
from macOS, from Linux, or even mobile OSs like iOS and Android.
In creating the P2S VPN configuration in Azure in your virtual network gateway,
you can choose 1 of 3 authentication options.
So you've got a choice with the protocol,
and you also have choice with authentication.
It wasn't too long ago where we didn't have choice,
where the only auth option in the Azure VNet gateway is client certificate.
The problem with that is that you've got to distribute client certificates to
all of the devices that are going to remote into Azure,
and that also means you have to upload the signing or
root cert directly into the gateway, which is a lot of management overhead,
and you track revoked certificates manually.
It's not a very scalable option,
and I'm so grateful that Microsoft has done engineering
work here to where we have other options.
I think the best option is Azure AD authentication because I would assume,
I guess, shouldn't assume,
but I would assume that if you're doing hybrid cloud and hybrid identity then
you already have your local Active Directory accounts synchronized with your
Azure AD tenant using Azure AD Connect cloud sync,
and in that case,
we can do Azure AD auth to allow a VPN tunnel on your client
devices into a target or hub virtual network,
and then you can use VNet peering to link that transit VNet with other VNets,
you see.
To do Azure AD authentication though,
you do have to be using the OpenVPN protocol,
but that extra setup, there is actually more setup to that as well,
you have to do some work in Azure AD to create a
service principal for Azure VPN.
Your client devices have to be using the Azure VPN client,
but the work there is going to pay off because,
number one,
you're using open VPN so you have much more wide
client operating system support, and number two,
you can layer in additional identity controls on the Azure side like
conditional access policies and Azure Multifactor Authentication.
We're not going to deep dive into setting up Azure AD
because the AZ‑800 exam actually calls out the third option
that we'll get to in just a second.
That said, check the exercise files because as always,
I like to provide supplemental pointers to the Microsoft docs to help you out.
That third option I was talking about that's specifically in
scope for exam AZ‑800 is where you want to authenticate
point‑to‑site VPN connections from local AD accounts that have
not been synchronized into Azure AD.
I mean, if you're doing the account synchronization,
then I would go Azure AD, but otherwise,
you can, in fact, configure your point‑to‑site VPN for local AD accounts, that's where the radius comes in, and let me explain more with a diagram.