So let's proceed with configuring Azure Virtual WAN to support
point‑to‑site connections for Always On VPN.
So here we are in the Azure management portal.
I'm in the resource group where I've already created my Virtual WAN,
and so I'm going to go ahead and click on my Virtual WAN.
And then over on the left in the Connectivity section,
you'll see there's a User VPN configurations.
So we'll go ahead and click on that,
and then we'll click Create user VPN configuration.
We'll provide a friendly name here.
And again, this name must not contain any spaces.
If it has spaces, the UI will complain,
so make sure that that doesn't contain any spaces.
The Tunnel type will be IKEv2 VPN.
Azure Virtual WAN does support OpenVPN,
but we can't use that necessarily for Always On VPN,
so we're going to select IKEv2.
And one of the things that I do like about this UI in
Azure Virtual WAN is that it does support defining our
custom IP site policy in the UI.
I really wish they would bring this over to the Azure Virtual Gateway.
It would make life a lot easier.
It certainly makes it more self‑discovering here.
And if you've set any of these settings incorrectly,
it's certainly more discoverable and easier to find if
you've made a mistake by just looking at it in the UI
versus looking at it via PowerShell.
So I'm going to do define our settings as we've defined
throughout this course using GCMAES28.
So, we'll click Next on Azure certificate.
And again, if you're using a device tunnel,
then we'll select Yes,
and we'll provide our certificate information just like we did previously.
So here I'm going to give this certificate a name,
and we're going to paste our public data just like
we did in the previous lesson.
This is the root certificate's public data, so we'll just paste that in there.
And at this point, you would just configure,
you could click Review + create,
but just want to demonstrate how you would set this
up for a user‑based connection.
So we would disable Azure certificate,
and then we would go to RADIUS authentication,
click Yes,
enter our primary server's shared secret and the
primary NPS server's IP address.
And if you want to provide a second server,
you can certainly do that here as well.
And interestingly,
Azure Virtual WAN requires you to upload the NPS server certificate,
so we'll give this a name here.
And once again, we're going to supply our certificate data here as well.
And at this point, we can then click Review + create and then click Create.
And after a short period of time,
our configuration should appear here in this configuration window.
The next thing we need to do now is to set up our VPN Gateway,
and to do that, we need to go over to Hubs.
So, once again, I've already deployed in Virtual WAN hub,
so I'm going to click on the hub that I've already created,
and I'm going to click here on User VPN (Point to site),
and now I'm going to click Create User VPN gateway.
Here is where we're going to select our scale units.
And as I mentioned before, you'll see that it supports an incredible scalability.
If I can go all the way down here,
you can see if I were to purchase 200 scale units,
I would get 10,000 clients times 10, so that is a pretty astronomical number.
So, for the purposes of our demonstration here,
I'll just select one with, you know, 2 scale units,
a paltry 1 Gb of throughput and 500 clients.
It's going to ask you for the point‑to‑site configuration.
This is the configuration that we just completed, so we'll click that.
We'll choose our preference.
In this case, we want to use a routing preference.
We're going to use the Microsoft network for that.
We will use a remote RADIUS server, so we'll select that.
And then we're going to add our client IP address pool.
And again,
we want to make sure that we have a large enough address pool
to support our expected number of clients.
And so since we're supporting up to 500 here, I'll use a /23.
And if you want to supply your own custom DNS servers,
that's a great idea because we needed to be able to resolve
our on‑premises Active Directory hostname,
so we'll enter our custom DNS servers here.
These are our on‑premises DNS servers.
Those servers could also be in Azure as well,
but they're capable of resolving AD, or Active Directory,
hostnames.
And then we'll select Disable for Propagate Default Route.
We don't need that option.
And now we'll click Create.
And at this point, as it's creating the VPN Gateway,
you're going to wait a rather extended period of time.
Usually takes about 30 to 40 minutes in my experience to create the gateway.
Through the magic of video editing,
I've spared you the agony of watching the gateway get prepared.
So now that it's all finished,
what we'll do here is click Download virtual Hub User VPN profile.
Doesn't matter which one you select here because we're really
not interested in the configuration itself,
just some information that's included in that.
So we're going to select EAPTLS, and we'll select Generate and download profile.
So once that's complete, we'll open this file,
and once again we'll double‑click on the Generic folder, and we
will edit the settings, or look at the settings, in the
VpnSettings.xml file. And once again, we're looking for the FQDN
here that is listed as the VpnServer.
So this VpnServer value is what you will again input into your
device configuration profile and Intune, or if you are using XML,
you would place this in the VPN Server field in your XML
configuration file. And at that point,
assuming all of your other configuration settings line up with the
way we've configured the hub, so in other words,
the gateway at part of this hub is set up to use either device or user tunnel,
then as long as we match those settings on the client side,
then we should be able to connect to the VPN Gateway and access any resources that are reachable on this particular Virtual LAN.