All right, moving onto the next demonstration.
Let's deploy a user tunnel using Intune.
So to provision our Always On VPN device configuration profiles using Intune,
we're going to open our web browser and navigate to endpoint.microsoft.com.
Once we're there, we'll click on Devices in the navigation tree here.
And then we'll click on Configuration profiles, and then click Create profile.
From the platform, we will select Windows 10 and later.
And Select profile type will choose Templates,
and we will choose the VPN template.
And once that's done, you can click Create.
So let's provide a descriptive name here,
and this is the name as it appears in Intune,
not on the endpoint.
We'll get to that shortly.
So we can call this whatever it is that we want.
You can provide a description if you like.
I'm going to go ahead and choose Next.
And then we need to select whether this is a User or a Device‑based connection.
In this case, we're going to select User.
From the Connection type drop‑down list,
there's a handful of choices that you have to make here.
Most of these here are third‑party clients.
The ones that were interested in specifically here are the Native types,
and interestingly, what you'll find here is that there is no SSTP.
You'll see that we have a bunch of different protocols here including Automatic,
but we don't have one that says specifically SSTP.
And that's fine because automatic is defacto SSTP.
It really is SSTP because Automatic prefers SSTP.
So when we want to deploy an SSTP‑based connection,
we'll choose Automatic there.
So next, we'll expand Base VPN, and we'll give this connection a name.
And this is the name as it appears in Windows,
so choose your name here carefully.
So next, we'll supply the name of our VPN server,
and we need to first provide a description.
And then we'll enter the public FQDN, or hostname,
of our VPN server and select True for the Default server.
And by the way, if you have more than one server,
this is not the place to actually do this.
This does not work as you would expect.
You can't have multiple servers here and have it just
automatically fall back to that.
We will certainly talk at length about that when we get to
the module covering high availability.
Anyway, so moving on.
We want to Register IP addresses with internal DNS, and this is optional.
If this is a user tunnel and you want to be able to manage your devices
remotely from the internal or the on‑premises network,
then you should be able to register those VPN client IP addresses internally,
but there's a caveat.
If you're going to do both device and user‑based connections,
you should only pick one, and you should pick the device‑based connection.
In this case since we're going to use both user tunnels and device tunnels,
I'm only going to configure internal DNS registration on the device tunnel.
So I'm going to leave this set to Disable.
But if you're just doing a user tunnel only, you certainly can enable this here.
Do we want to enable Always On?
Of course.
This is a course about Always On VPN, so we want to select Always On there.
Remember credentials, since we're using certificates we don't want to do that,
so we'll select Not configured.
For our Authentication method, we're going to use Derived credential,
so select that from the list.
And here in this EAP XML field,
this is where you will paste the content from the XML file
that we exported in the previous lesson.
You'll recall that we ran the PowerShell module or the
PowerShell command get EAP configuration.
It produced a file.
Open that file with Notepad, put it on your clipboard,
and we'll just paste that right in here.
Next,
we'll expand the DNS Settings. And here we want to enter
our DNS suffix for our internal domain,
so this is your internal or on‑premises Active Directory domain name.
We're not going to define the NRPT, or the Name Resolution Policy table,
just yet.
We're going to talk about that in the next module.
So for now, we're going to leave this empty.
So expand Split tunneling.
If you are planning to do force tunneling, there's nothing to do here,
but if you're following best practices and using split tunneling,
then select Enable.
And here we're going to define our internal routes.
So we'll enter our first IPv4 address here,
and we'll include our Prefix size here as well.
Now, unfortunately, we are unable to use IPv6 in this particular UI.
Today, as it stands, as we're recording this,
there is a validation bug in the UI that prevents us from
entering the IPv6 prefixes correctly.
I'll show that to you just so that you can see what it looks like.
So let's enter our IPv6 prefix here (typing),
and here you'll see that the UI complains that the
value must be between 1 and 32.
Quite clearly,
this is expecting an IPv4 address here because 32 is
the longest subnet length in IPv4.
The standard subnet length in IPv6 is 64, and in this case,
I'm actually routing the entire /48,
which is a site prefix for this particular location.
I'm actually sending that over this tunnel,
and so it doesn't allow me to do that.
So unfortunately, this is broken.
If you're doing IPv6, there's another way to do that.
We'll see that in the next lesson.
Moving on to the Trusted network detection. Here is,
Trusted Network Detection is basically a feature of Always On
VPN that prevents the VPN from connecting automatically if
it's on your internal network.
There's no point in establishing an Always On VPN connection if you're
already on the same LAN connected to those resources,
right?
So in this scenario, we need to tell it what is our trusted network,
and it basically works by matching the DNS suffix that's
assigned by DHCP on the internal network.
So if you get a DNS suffix that matches what the administrator inputs here,
then the connection will not start.
And this is most commonly your Active Directory domain name,
but it could be something else.
And of course, if you have multiple internal DNS suffixes,
you certainly can add those here.
So once that's done, go ahead and click Next.
And now we're going to assign it to a group, so I'm going to click Add groups.
And I'm going to find my VPN Users group, select that, and click OK.
And once that's done, we'll choose Next.
And if you choose to use Applicability Rules, you certainly can do that.
I don't, but I'll go ahead and choose Next.
And at this point, I can click Create.
And now the profile has been created.
If I go back to my Devices and Configuration profiles,
you will see I have an Always On VPN User Tunnel here.
And now this VPN profile will be pushed out to anyone who is in the Always On VPN Users group.