All right, let's proceed to the demonstration.
And we'll deploy user and device tunnels using PowerShell.
So to deploy Always On VPN client configuration settings using PowerShell,
we need two things.
The first is PowerShell, obviously,
and you should have the AOVPN tools PowerShell module installed to do this.
There is a PowerShell script on the Microsoft website that supports this.
I would discourage you from using that.
It's not very good.
It doesn't follow implementation best practices.
Also, it is not nearly as robust as my script,
which I'll show you here in just a second.
And my script is actually a part, it's a function in my PowerShell module,
so we'll take a look at that.
And specifically,
the name of the module or the function that we're looking
for in our module is New‑AovpnConnection.
This function is used to install the XML configuration file,
and it does so in a much more effective and efficient
manner than the Microsoft tools.
So, we also need this XML configuration file.
Now, I've already created one here,
so I'm going to take a look at that in Notepad.
And this XML configuration file, I realize it might look a little bit daunting.
It's actually fairly straightforward.
You can actually find and you don't have to create this
entire thing from scratch yourself.
You can actually, if you go to my GitHub,
so if you go to github.com/richardhicks,
look in the aovpn repository.
If you scroll down here in the middle,
you will see there are a couple of sample files for XML files.
So there's a ProfileXML for device and user.
I would suggest you take a look at these,
download them,
and use them as a starting place because a lot of this has
the settings explained and defines what the values are or
what potential values are.
We have some samples in here and so forth,
and you can see what this content should look like.
Now this file is a template, it is a starting point.
You'll have to, of course,
make some settings changes and adjustments to it as well.
And by the way, if you have questions about what the supported values are,
I would encourage you to take a look at the VPNv2 CSP reference.
This is a reference document on the Microsoft website that
outlines all of the information that's supported there and the
correct syntax and format and whatnot.
And you can find this by going to your favorite search
engine and just typing in vpnv2csp, no spaces.
It'll usually take you to this link here on the Microsoft website.
And here if you scroll down, you'll see that this is the schema outline.
So this is the order or the levels in which these
specific settings would be defined.
They can be moved around, but they have to be in this hierarchy.
But if we scroll down farther, you'll see,
for example,
this is the setting for how the routes are configured and so
what are the values supported here and whatnot.
You'll also find things like, oh, there's an exclusion route.
How does that work?
What version of Windows is it supported and so forth.
So there's lot of information here.
This is a fantastic resource,
and it's one that you'll probably be using quite a bit.
But once you have this configured, we'll go and enter all of our information.
And by the way, you'll see that there's a ton of information here,
but this particular block of code here, everything in the EapHostConfig,
and let me scroll down and show you everything here.
Everything in this particular section is actually defined in our
EapConfig XML that we exported in the previous lesson.
If you recall, we ran the PowerShell command get EAP configuration.
We saved that out to a file here on the desktop.
And now what I've done is I've taken that information, and in the last lesson
we pasted that into Intune. Here we're going to paste it into our XML
configuration file between the Eap Configuration section.
So when you download my template, this will be missing,
and then all you have to do is just paste your information in there.
But bottom line here is you can see I've set this to AlwaysOn is true.
I've added my DnsSuffix.
I've added my TrustedNetworkDetection information,
my VPN servers and my ProtocolType and so forth.
Down towards the bottom, you'll see that I have split tunneling enabled,
I have disabled my ClassBasedDefaultRoute,
which is the default recommendation.
And I've added some routes to the tunnel.
And here, of course,
you can see that IPv6 is supported in the XML unlike it was in
Intune because of that bug that I showed you.
So if you're planning to use IPv6 then you'll,
of course, need to provision Always On VPN using the XML route.
So anyway, so getting back to our PowerShell.
So now that once we have this configuration file saved,
the profile XML,
we're going to go ahead and install it using my PowerShell command here.
So I'm going to run New‑AovpnConnection. I'm going to specify the
xmlFilePath parameter and enter the path to the file.
And then if you want, you can use the ProfileName switch and provide your
own unique profile name, so that's how it appears in the Windows UI. By
default, this function just creates a connection called Always On VPN, so
I'm going to leave it at that.
So at this point, I'm going to go ahead and hit Enter and let this
run. And if everything goes according to plan and we don't have any
problems with our XML configuration file,
we should have a successful VPN creation. And since
this client is in the field right now, it's outside the network,
we should actually see that connection already established, and sure enough, Always On VPN Connected.