So now that we have our user tunnel provisioned,
let's move on to deploying our device tunnel.
So here we are, once again, in the Endpoint Manager Management Console.
We're going to navigate to Devices, Configuration profiles.
Once again, we'll click Create profile, and just as before,
we'll select our Windows 10 and later for the platform,
and we'll choose our templates, and we'll also choose VPN.
Click Create, give this a name.
And here, we're going to select Device from the drop‑down list,
and our connection type here has to be IKEv2.
Remember, IKEv2 is the only supported protocol for the device tunnel.
So if you're setting up a device‑based connection,
then we must use the IKEv2 protocol.
Expand based VPN, provide a name for the connection,
and again, this is much like the user tunnel.
This is the name as it appears in the UI on your Windows endpoints.
And once again, write a description, enter the public FQDN of the server again,
select it as the default server, and in this case,
I'm going to register my IP address with internal DNS
because this is a device‑based connection,
so I'm using it in combination with a user tunnel,
so this is the tunnel that I want to register, Always On,
of course, remember credentials.
We don't need that because we're using certificate authentication.
The Authentication method here now is Machine Certificates.
Now it's going to prompt you for an authentication certificate here,
you can actually safely ignore this.
As long as the certificate is already deployed on the machine,
there is no point in doing anything here.
So you can ignore that.
This is a device tunnel, of course, so we're going to choose enable,
and here, you'll notice that we have some IKE SA,
or security association parameters, so we need to choose these carefully.
They need to match exactly what we defined on our server.
So if you'll recall,
we were using GCM‑AES‑128 and SHA‑256 and the DH group was 14,
so that's our main mode SA parameters.
For our child mode or for our quick mode parameters,
once again, using GCM‑AES‑128 and GCM‑AES‑128 again,
and our PFS, if you recall, was ECP 256 when we defined that on the VPN tunnel,
that is technically speaking, DH group 19.
So we'll go to the DNS settings, and much like we did with the user tunnel,
supply our DNS suffix, select Split tunneling,
and choose Enable, add our IPv4 prefix here.
And remember on the device tunnel from our conversations earlier in this course,
we don't typically use broad subnets when we're
defining our device tunnel connections.
Our device tunnel, we want to provide limited access.
Remember,
the device tunnel is really only there to provide pre‑logon
connectivity to support things like logging on without,
with cache credentials.
So in this scenario, I'm not going to add,
you know, /8 or /12 or 16 networks, I'm actually going to add /32s,
which are host routes.
So I want to restrict the VPN device tunnel to my domain controller,
in this case, so I'll put in that IP address here,
and then the prefix size is 32, meaning a host route.
And if you have more than one domain controller, you can certainly put those in.
If you have other servers that you want to be reachable over the device tunnel,
you can add those as well.
Those could be SCCM distribution point servers,
they could be other systems update or patch management servers,
any number of servers you want,
it could be even a management workstation and so forth.
So you would enter those IP addresses here.
So we'll choose Trusted network detection,
and once again, put in our DNS suffix.
We'll choose Next, and click Add groups,
and let's find our VPN Devices group, click Select, Next.
I'll skip the applicability rules, we'll choose Next,
and then click Create, and once again, our profile has been created.
So let's go back and review, (Working) and you'll see we now have a device‑based connection or a device tunnel provisioned.