Step by Step Create a User P2S VPN using Azure Secured Virtual Hub and Azure Active Directory #SDWAN #Azure #Secure   Leave a comment

There are multiple ways on how to use a VPN and how to connect and use this. In this blog I use an Azure Virtual WAN Hub with associated security and routing policies configured by Azure Firewall Manager.

When connecting to your Virtual Hub over the IKEv2 protocol, you can use certificate-based authentication or RADIUS authentication. However, when you use the OpenVPN protocol, you can also use Azure Active Directory authentication.

I will use the open VPN with Azure Active Directory authentication. Remember this is only supported on Windows 10 as you will need the Azure VPN client from the microsoft store.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

For giving the vpn application the proper permissions, you need to register the application to your Azure AD first.

below is the default URL that can be used to trigger the registration, use the proper rights to create an enterprise App in you Azure AD

https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent

Sign in with the proper credentials

image

Using the wrong account will end up in

AADSTS50020: User account  from identity provider ‘live.com’ does not exist in tenant ‘Microsoft’ and cannot access the application ‘4b4′(Azure VPN) in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

When Accepted the you will be redirected to the Azure portal.

image

In the Azure portal you can go to the Azure active directory and

Enterprise applications | All applications  and search for Azure VPN

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Now that the basics are in place, we can configure our Site to Site VPN profile the following information is needed.

Go to your Virtual Wan and select the user VPN configuration

imageimagehttps://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Create User VPN ##### I noticed during the writing of this blog post the screens may differ as the portal changed the layout#######

  • Configuration name – Enter the name you want to call your User VPN Configuration.
  • Tunnel type – Select OpenVPN.
  • Authentication method – Select Azure Active Directory.
  • Audience – Type in the Application ID of the Azure VPN Enterprise Application registered in your Azure AD tenant.
  • Issuerhttps://sts.windows.net/tenantID/
  • AAD Tenanthttps://login.microsoftonline.com/TenantID

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select open VPN

go to the Azure Active Directory <> properties and grab the Tenant ID

image

image

Set the switch to yes and new fields will open.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

#the number is your tenant ID

image

Now that the VPN user profile is created we can configure the HUB

image

Now that the user vpn profile is created we can create the P2S VPN.  Select your hub

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select the user VPN point to site VPN  select create

image

Creating a VPN gateway you need to select the just created User profile.  

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Select a proper IP subnet and if needed a DNS server for the workload into that network

Updating a hub can take 30 minutes or more.

image

Download User VPN profile as we need this on the Windows 10 client later.

Use the VPN profile to configure your clients.

  1. On the page for your Virtual WAN, click User VPN configurations.
  2. At the top of the page, click Download user VPN config.
  3. Once the file has finished creating, you can click the link to download it.
  4. Use the profile file to configure the VPN clients.

imageimage

To download the Azure VPN client on your windows 10 test device.

Use this link to download the Azure VPN Client.

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011image

Open the VPN Client you can add a new VPN or import a Connection

image https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

For Importing the Connection we need the just downloaded zip file and extract this in the AzureVPN folder there is a XML that holds the vpn configuration.

image

image https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

If any thing goes wron with the import it is 99% your pbk file,

 

image

go to the following folder and delete the files – this will probably also remove your other vpn connections it you had any.

%userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk

C:\Users\admin\AppData\Local\Packages\Microsoft.AzureVpn_8wekyb3d8bbwe\LocalState

imageimage

Now that the Import worked and you are ready to connect to the VPN in Azure.

image

  Use your Azure AD credentials or your FIDO2 key

imageimage

 

image

  Now we are fully connected to the Secure Virtual WAN in Azure

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

It can take some time to see your connection in the portal

image

Showing the above it all is easy to setup this but I already see the questions yes but I need to do this on 5000 Windows 10 devices.  

Microsoft Endpoint Management is your best friend.

Deploy VPN with Microsoft Endpoint Management 

We create a Custom Template and do not select the VPN option as this is not for uploading the XML

image

image

In our Custom settings we add the Following settings

  • Name: Enter a name for the configuration.
  • Description: Optional description.
  • OMA-URI: ./User/Vendor/MSFT/VPNv2/demo01_hub-weu/azurevpnconfig.xml (this information can be found in the azurevpnconfig.xml file in the tag Name).
  • Data type: String (XML file).

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

Now that this is done we can create some assign ments and test this on the pilot group

image

 

As you can see there are a few steps involved and are linked together

https://docs.microsoft.com/en-us/learn/modules/introduction-azure-virtual-wan/?WT.mc_id=AZ-MVP-4025011

 

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted May 24, 2021 by Robert Smit [MVP] in Azure

Tagged with ,

Get the new PowerCLI: An Aspiring Automator’s Guide from #Altaro Get started on your path to automation greatness #Poswershell #vmware #Cli #vSphere   Leave a comment

PowerCLI: An Aspiring Automator’s Guide

Getting into scripting can be daunting. It’s easier to just use existing scripts found online, but if you choose this route you’ll quickly run into limitations. If you take the time to learn how to create your scripts, trust me, you’ll never look back!

clip_image002

Automating vSphere is particularly useful for countless applications and the best way is through PowerCLI – a version of PowerShell developed specifically for VMware. Learn how to develop your own PowerCLI scripts with this free 100+ page eBook from Altaro, PowerCLI: The Aspiring Automator’s Guide.

Written by VMware vExpert Xavier Avrillier, this eBook presents a use-case approach to learning how to automate tasks in vSphere environments using PowerCLI. We start by covering the basics of installation, set up, and an overview of PowerCLI terms. From there we move into scripting logic and script building with step-by-step instructions of truly useful custom scripts, including how to retrieve data on vSphere objects; display VM performance metrics; how to build HTML reports and schedule them; the basics on building functions; and more!

Stop looking at scripts online in envy because you wish you could build your own scripts.

Get started on your path to automation greatness – Download the eBook now!

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted April 26, 2021 by Robert Smit [MVP] in Altaro

Tagged with

Registration for The Microsoft Ability Summit is open! #Ability #Summit #AI #Office #Windows #Xbox   Leave a comment

The Microsoft Ability Summit is a two-day, free digital event experience that brings together people with disabilities, allies, and accessibility professionals to Imagine, Build, Include, and Empower the future of disability inclusion and accessibility. We encourage all to join on May 5-6, 2021 and spread the word throughout your internal and external communities.

Registration is now open for Ability Summit on May 5-6th

clip_image002

Registration for Ability Summit is open!

  • Wednesday, May 5 from 9:00 AM – 12:30 PM, PT
  • Thursday, May 6 from 9:00 AM – 12:30 PM, PT

Microsoft Ability Summit 2021 will feature:

  • Keynotes from Microsoft executives and notable members of the disability community
  • Expert panels featuring exciting projects and innovations
  • Demos of the latest accessibility features in Office, Windows, Xbox, and more
  • All sessions will be recorded and available post-event so no matter what time zone you are in, you can access the content at a time that works for you!

Registration is now open for Ability Summit on May 5-6th

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

Posted April 15, 2021 by Robert Smit [MVP] in Event

Tagged with

Effective March 31, 2021, the Azure portal will no longer support Internet Explorer 11. Start using the new Microsoft Edge for speed, security and privacy   Leave a comment

Well on every server or Windows device there is the Internet explorer and prepairing some server workloads you may need some browser and may need to connect to Azure. using an old browser is always an bad idea.

When setting up a new server what ever version it is I always remove the IE icon and install Msedge this works fine and gives me a more secure feeling.

Microsoft Edge

Opening the Azure portal with IE you will see a warning about non supported browser.

Microsoft Edge

With the option to download the Edge directly

Microsoft Edge

The portal still opens in IE but using some functions are not working sample as anything that will use HTML5

Microsoft Edge

Official Download links for Microsoft Edge Stable Enterprise

I’m not 100% sure it’s final but anyone who wishes/wants can test it.

Microsoft Edge Stable Enterprise

X64.msi
http://go.microsoft.com/fwlink/?LinkID=2093437

X86.msi
http://go.microsoft.com/fwlink/?LinkID=2093505

MicrosoftEdgePolicyTemplates.cab
http://go.microsoft.com/fwlink/?LinkID=2099616

MicrosoftEdgeIntunePolicyTemplate.cab
http://go.microsoft.com/fwlink/?LinkID=2099617

macOS.pkg
http://go.microsoft.com/fwlink/?LinkID=2093438

Blocker Toolkit to disable automatic delivery of Microsoft Edge
https://docs.microsoft.com/en-us/deployedge/microsoft-edge-blocker-toolkit

So when you want to auto mate this the following lines could be used to install quickly Microsoft Edge

#Create temp folder
New-Item -Path ‘C:\temp’ -ItemType Directory -Force | Out-Null

#Install Edge
Invoke-WebRequest  -Uri "
http://go.microsoft.com/fwlink/?LinkID=2093437" -OutFile ‘c:\temp\MicrosoftEdgeEnterpriseX64.msi’
Invoke-Expression -Command ‘C:\temp\MicrosoftEdgeEnterpriseX64.msi /quiet /norestart’

This will install Microsoft Edge and you can set this in a powershell script and in the GPO that way all new servers will get Microsoft Edge.

 

Follow Me on Twitter @ClusterMVP

Follow My blog https://robertsmit.wordpress.com

Linkedin Profile Robert Smit MVP Linkedin profile

Google  : Robert Smit MVP profile

 

World Backup Day :This World Backup Day, WIN with Altaro! #Altaro #Backup #Win #O365 #vmware   Leave a comment

 

This World Backup Day, WIN with Altaro!

As World Backup Day approaches, we're reminded of all the mishaps, backup scares, and  near-catastrophes that we've experienced over the years – and how grateful we were to have backup during those times!

As World Backup Day approaches, we’re reminded of all the mishaps, backup scares, and near-catastrophes that we’ve experienced over the years – and how grateful we were to have backup during those times!

If you use Microsoft 365/Office 365, Hyper-V or VMware, celebrate with us. All you have to do is sign up for a 30-day free trial of either Altaro VM Backup or Altaro Office 365 Backup – it’s your choice!

What can you win?

  • Receive a guaranteed €20 Amazon voucher when you sign up for and use the trial of Altaro Office 365 Backup or Altaro VM Backup
  • Get a chance to WIN one of our Grand Prizes when you tell us about your funniest IT catastrophe!

clip_image002[6]

What are you waiting for? Sign up now!

Posted March 26, 2021 by Robert Smit [MVP] in Altaro

Tagged with

  • Twitter

  • RSS Azure and Microsoft Windows Server Blog

  • %d bloggers like this: