In this demonstration,
we're going to take a look at Azure point‑to‑site VPN setup,
and, in particular,
what goes into configuring RADIUS authentication when you need
to have local Active Directory users authenticate their P2S VPN
with their local domain identities.
So we're on a domain member server here, a Windows Server 2022 box.
I'm signed into Windows Admin Center.
The server, as you can see, is localmem1.contosolocal.int,
and I've just gone over to the Roles & Features area and verified
that I installed network policy and access services.
That's all there is to it as far as that goes.
Then you've got an MMC console called Network Policy Server.
And we've got here RADIUS Clients and Servers.
We're going to need to create a RADIUS client for our Azure VNet gateway.
And then, under Policies,
we have our connection request and network policies that we'll need to
configure just to allow the P2S connections when they're initiated to
be handed off for Active Directory authentication before they're
rerouted across the P2S tunnel.
So, that's what we've got.
Let's go to NPS,
and there's actually a wizard that allows you to abstract away the
complexity of going to those nodes individually.
So let's make sure that this standard configuration is
set up for dial‑up or VPN connections, and then we'll click Configure VPN.
I'm going to make this a virtual network connection
and we'll call it Azure‑ P2S‑VPN, and click Next.
We need to create a RADIUS client here.
The friendly name for this is going to be our Azure VNet Gateway,
and here, if you've used the Azure VNet Gateway,
you might be thinking, how do we get the address of the gateway?
We know that the gateway has a public address.
Let me show you.
Let's go out.
I've got a virtual network gateway called vpn‑gateway, really imaginative.
It's a VpnGw1 SKU, it's route‑based,
it's in a virtual network I have called vnet11.
If we jump over there and go to Subnets,
it's sitting on a GatewaySubnet at 10.11.1.0/24.
That's actually what we need is that subnet ID.
Well, let me, it won't let me copy it, so let me just try to remember,
10.11.1, 10.11.1.0/24.
Okay, and then to authenticate client and server,
we're just going to do a preshared key, and then,
actually, I'm going to forget it.
There we go.
Hopefully, I'll remember this one.
And we're going to need that both here in the NPS RADIUS server,
as well as we'll configure it in the point‑to‑site
settings on the Azure Gateway.
Let's click Next.
And now, what are we doing for authentication?
We're going to use EAP here, and specifically,
we're going to do a secure password, EAP‑MSCHAP v2.
I'll just leave the defaults for that.
For our Groups here,
we're just specifying the constraints that govern this particular policy.
I'm going to say that domain admins are going to be
allowed to authenticate the P2S tunnel.
We're not going to worry about filtering IPs,
I'm just going to leave the encryption settings,
we're not dealing with realms, we're not dealing with internet service providers.
Let's click Finish.
It's pretty much done.
Again, we're not concerned with deep‑diving into NPS,
I just want to give you the general flavor.
The bottom line is that we've got a RADIUS
client‑defined that points to our Azure gateway,
and we've created policy at this point that's saying that if
you're coming in and setting up a VPN,
and you're a member of the domain admins group,
we're going to allow that connection to proceed.
Now, as far as setting up the virtual network gateway,
let's go back to that gateway,
and instead of configuring express route or site‑to‑site VPN,
which happens with connections, we're going to go to point‑to‑site configuration,
and it's not configured, so we're going to configure it now.
We specify a client address pool.
This needs to be a non‑overlapping address range of private addresses that
will be given to clients coming in on the P2S tunnel,
and they'll be put into this virtual network gateway and Azure
routing will allow connectivity between those hosts and any
other resources that are in the VNet.
As I mentioned, we have a lot of options for Tunnel type.
I like, for most compatibility, the IKEv2 and OpenVPN,
but I don't have the Azure VPN client available to me right now,
I'm just going to use the one that's built right into Windows Server.
And it is Windows in my situation only,
so I'm going to do IKEv2 and SSTP this time around.
Now, here's the exam alert.
For Authentication type, we're not going to do a certificate.
In the next demo, with Azure Network Adapter,
you'll see a little bit about that.
If you do Azure AD, there's some additional work you have to do,
like I said, to get that set up in your tenant.
But what we're going to do is just the one authentication
type and that is RADIUS authentication.
And here, we need to provide our primary server address,
which is going to be the address of our host,
the private address of our host, which is,
in my case, let me do a quick ipconfig, 10.1.10.158,
10.1.10.158.
And the shared secret, carefully type that in.
Unfortunately, it shows up in plain text.
I don't have a secondary server IP or secondary secret,
so I'll leave that, and click Save.
So this is going to take a little while to commit because what's happening is
Azure is now creating that point‑to‑site configuration for us,
and it's also building the client VPN package.
See,
this Download VPN client button is going to activate
once Azure completes the configuration,
and there'll be a number of profile files in there that you can use.
For example, if you have the Azure VPN client,
that's the Windows Store app that's good for Windows 10 and Windows 11,
not good on Windows Server, can't get to it there,
but it's good for Windows 10 and Windows 11,
you can do an import.
But what I like,
and one reason why I chose IKEv2 and SSTP is that we'll also get an installer,
a Windows installer,
that will create a VPN connectoid that works on Windows
Server just with the native Azure VPN client.
That's what I'm looking at in this case.
Great.
Saved virtual network gateway.
Looks like we're ready to test.
Let me download the VPN client.
I'm going to bring it down as an EAPMSCHAPv2.
All right, click Download.
Let me open this in the folder to make sure I'm getting the most recent one.
Looks like I downloaded it twice accidentally.
We extract this to my desktop, and as I said,
there's a number of different configs here.
There's Generic, there's Mac mobileconfig, there's Windows 32 and 64‑bit.
I'm going to go to AMD, and this is a nice installer, like I said.
Do you wish to install a Vpn Client for vnet11?
Yes.
And then if we look for VPN in the start.vpn settings on the systems app,
then we've got our vnet11 Connect, it brings up our Azure VPN.
And because we've wired up RADIUS authentication,
we'll use either an NT, this is contosolocalint\user,
or we could do the UPN notation, password,
Connect.
Elevated privilege required, do not show again.
And that's all there is to it.
Once the handshaking completes, I don't think it liked that.
Let me try one more credential.
Let me do tim@contosolocal.int.
Carefully type in my password, and I'll save it, and then Connect.
It looks like I've got some more troubleshooting and some work to do here.
Probably there's something that's gone sideways in my network policy server.
But you get the idea.
We've got a persistent VPN connectoid here that whenever we want
Layer 3 connectivity to that Azure virtual network,
all we have to do is stand up the point‑to‑site VPN,
disconnect it when we're finished, and we're off and running.
So this demo is going to serve as a nice precursor to what we'll do in the next demo with Azure network adapter.