Alright, so let's configure RRAS in Azure.
So here we are in the Azure portal,
and I am in the resource group where I have deployed an Azure
Virtual Machine running Windows Server 2022,
and the VPN server configuration is identical to that
that we did in the earlier lessons.
So we won't go over the configuration here,
I don't want to rehash that, but fundamentally,
I just want to point out the things that are unique to deploying RRAS in Azure.
So I've deployed a virtual machine, I also needed to assign a public IP address,
so I've created a public IP address and a network security group.
Now the public IP address, let we demonstrate this here real quick.
If I go to the IP address and then go to Configuration,
by default, I've just selected a dynamic IP address here,
and you'll see that it has this particular IP address,
at least right now.
If I maintain this service state and keep it up and running perpetually,
this will probably never change,
but it's a good idea to provide a DNS name label here,
it says it's optional, but for our purposes we really want to do this.
So we're going to give this a name, and we'll make sure that that name is valid,
it has to be unique,
and then what we're going to do is we'll save this and then
we will create a DNS record that is a CNAME record that
resolves our public host name, so like vpn.example.com,
that will, instead of resolving to the IPv4 address in an A resource record,
we're actually going to resolve it to this name or translate it
to this name as an alias or a CNAME record,
and then Azure essentially manages this mapping for us.
So if this IP address ever changes on us,
Azure will update this so we don't have to make any changes to DNS.
Azure does that for us.
The other option here, of course,
is just to simply choose a static IP address and then you would
create an A resource record and map this particular IP address
because then obviously it would never change.
The choice to do a static or dynamic is entirely up to you.
A static IP address may have some additional costs,
I don't know for sure, but either one will work.
Certainly the simplest way is to do a static address
assignment in an A resource record, but again,
if you choose dynamic,
just make sure you assign a name and then map this name
via CNAME to whatever public host name you plan to use for
your clients to connect to.
So the next thing I want to demonstrate here is the network security group.
So obviously,
we have a public IP address, and we don't want to
allow all traffic in from everywhere.
So here, what I have done, is I've created a network security group,
and I have created three rules, and you'll see these here.
So I have allowed HTTPS, which is TCP port 443,
that's our protocol and port required for SSTP,
and then I've allowed UDP 500 and 4500 inbound.
Those are the only three ports that should be open on the NSG.
Next, if we take a look at the Azure virtual machine,
I want to go over to the Networking tab and then go to the Network Interface.
So I'm going to select Network Interface,
and here, let's go to IP configurations,
and we need to enable IP forwarding.
So in order for this to work, we need to enable IP forwarding.
So once we've done that, we'll click Save,
and then the last thing that we'll need to do is if we
go back to our resource group here,
we will need to create a route table because we need to tell the
Azure infrastructure where to route this traffic.
So I'm going to click Create, I'm just going to enter route table here,
and then select Route table, click Create,
and then we will assign it a region, give it a name,
we'll select No for Propagate gateway routes,
and then click Review and create.
Once that's complete, we'll go to our resource,
and then we'll click on Routes and we'll click Add,
and here,
we're going to give this a route name and this is our VPN client subnet,
so we're going to end, I'll just enter that here,
and the address prefix is an IP address,
and the source IP address range is our prefix that we're going to
assign to our VPN clients for this particular server.
So if you'll recall from our earlier lessons,
we assign an IP address pool to our VPN clients when they connect,
and so I'm going to enter that here inside our notation.
The Next hop type here will actually be virtual appliance,
and the next hop address is the IP address of the
VPN server that owns this prefix.
So this is a single server deployment,
but if you had multiple servers you would want to make
sure you use the correct IP address here.
So once we're done, we'll click Add,
and once the route has been successfully added,
we'll need to assign it to a subnet.
So now I'm going to go back to the Subnets,
and we'll click Associate,
we'll select our virtual network and then a subnet within that
virtual network that we want to assign it to,
and click OK.
And at this point,
Azure now knows to route the 172.21.12.0/24 network back to the VPN server.
So at this point when clients connect to the VPN server,
they'll get an IP address from that pool, and now the
Azure infrastructure will know how to properly route that
traffic back to the VPN server.
The last point I want to make here is that you would need to
associate this route table with any subnets for which clients
would need to be able to reach resources on.
Also,
if the clients need to connect to the VPN and then traverse a
site‑to‑site VPN or an ExpressRoute connection,
you will also need to assign the route table to those VPN gateways that for those connections, so be aware of that.