So let's configure Azure VPN gateway to support point‑to‑site VPN connection.
So here we are in the Azure portal, and in this case,
I've actually navigated to my resource group where my Azure lab VNet is
already configured, as well as my Azure Lab VPN Gateway.
So I'm going to click on the VPN Gateway link here,
and on the left you'll see we have a Point‑to‑site configuration.
So let's go ahead and click on that, and then we'll click Configure Now.
And here we're going to supply an address pool.
So the address pool must be unique in your environment.
It cannot be in use anywhere in Azure,
so this has to be a completely unique subnet,
and it's entered here inside your notation.
So I'm going to do this in a very simple way, I'm just going to use a /24.
So in terms of VPN protocols, here we want to select either SSTP or IKEv2.
You actually can do both on the same gateway,
that's not a problem,
but as this gateway is really focused on either device
connections or user connections, it's probably best to select one.
So I'm going to demonstrate setting up the gateway here for
device‑based connections using IKEv2.
So I'm going to select IKEv2,
and then with the authentication type, you're going to
see we have a couple of options here.
Here we're going to select Azure certificate,
and it's somewhat misleading because it's not a certificate,
you know, generated by Azure, this is actually your on‑premises CA certificate.
This is the certificate that's going to be the root of trust
for the certificates that you're issuing to those devices
that you want to allow to connect.
So in this case, it would be our on‑premises root CA server.
So I'm going to select Azure certificate. So we'll enter a name,
and then for the Public certificate data,
unfortunately there's no way to just simply upload a certificate,
that would be really helpful here,
but we have to supply the base64 encoded data that's a
part of the root CA certificate.
So the best place to get this is actually just from any
domain‑joined system in your environment.
So here we are on a domain‑joined system,
I'm just going to open up the local computer certificate store,
I'm going to navigate to the Trusted Root Certification Authorities folder,
and I'm going to locate my root certificate.
And it is this one right here.
And the best way to do this is just simply right‑click,
choose All Tasks, Export, choose Next, select Base‑64,
this is critical, and then choose Next, and then supply a file name for this.
Choose Next and Finish.
So once we've saved the certificate,
let's right‑click on the certificate and choose Open With,
and we'll select Notepad.
And here, what we want to do is,
unfortunately we don't want to copy the entire block,
that would obviously make sense,
but that's not what the Azure interface is looking for.
What we need is everything between the lines BEGIN
CERTIFICATE and END CERTIFICATE.
So in this case, we want everything in like this.
So we don't want to include both the beginning and end tags there.
So we're going to copy this, I'm just going to put it on the clipboard,
and then we're going to jump back over to the Azure configuration,
and we'll simply paste that here.
And then also,
I just want to bring your attention here that there is
this section called Revoked certificates.
Revoked certificates means that if there's any certificates for devices
that you want to prevent from accessing the VPN gateway,
and again, this isn't a device‑based scenario,
then you would just simply provide the name and the
thumbprint of that certificate here,
and then the Azure VPN gateway would deny access to them.
And the reason for this is because the Azure VPN Gateway does
not have access to your CRL infrastructure so it doesn't
perform CRL checks in the standard way,
we have to explicitly tell it which devices would not be allowed to connect.
So once we're done here, we'll click Save,
and then once the gateway is finished saving,
now we'll click our Download VPN client,
and then once that's downloaded, we'll just open this file,
and then we'll double‑click on the Generic folder,
and then we'll open this VpnSettings.xml file.
Now, this XML file is not useful at all for Always On VPN.
The only reason we're looking at it here is that we need the VPN server name,
so we need to know what the name of this VPN gateway
is because we don't define that, it's defined by Azure.
And you'll find it here in this VpnServer section.
So it is this value that you will put in your Always On VPN device
configuration profile in Intune as the server name,
or if you were using XML,
you would put this in for the VPN server value in your XML.
So it does look, you know, rather complex.
The good news here is that it's not anything you have to remember,
it's not anything that you're ever going to ask users to type in,
you just need to copy and paste this value into your
configurations and you're good to go.
The final piece of configuration for Always On VPN
point‑to‑site gateway using IKEv2 in the device tunnel is to
configure our IPsec security policy.
If you'll recall, when we did that with Windows Server,
we used PowerShell,
and that's the same process that we'll have to go through to
set the policy on our VPN gateway as well.
It's a little bit different though.
If you've never managed Azure using PowerShell,
you'll first need to install the PowerShell management module,
and that command is Install‑Module Az.
Once that's installed, then you'll just run the command Connect‑AzAccount,
you'll log in and authenticate to Azure.
You should,
if you have multiple subscriptions, you'll want to run the command
Get‑AzSubscription and then identify the correct subscription that you
want to manage where your gateway is installed,
and then enter that as the SubscriptionId to select AzSubscription,
and at that point, then you can continue with configuring the policy.
And you can configure the IKEv2 security policy using
the commands on your screen here.
These are the same parameters that we used when we
configured on‑premises Windows Server,
and so these settings will match those that are configured on the client.
And again, these are kind of minimum baseline recommendations for security.
Then you'll set the policy in this first block here,
and then in the second block, this is where you actually set the policy itself.
And then once that's done,
if you just want to validate that the policy is actually installed correctly,
the command to do that is just Get‑AzVpnClientIpsecParameter.
And, of course, you'll have to put in your gateway name,
these are just placeholders here.
Put your gateway name and resource name and then
you should have that policy set, and the policy should match that that's configured on the endpoint.