Hi All, Wondering that something not able to find in XML based AOVPN profile when compared to VPN profile which can be created in Intune itself directly. From the below article, i could see that its possible to multiple DNS Suffix and persistent NRPT but not able to find how it can be achieved through XML based profile. https://github.com/MicrosoftDocs/IntuneDocs/blob/master/intune/configuration/vpn-settings-windows-10.md Appreciate if any one can help in this to add multiple DNS Suffix and Persistent NRPT to create XML based AOVPN profile and push through intune. Currently profile is pushed based XML file and just wanted to update the same. Regards Mahesh

@Mahesh Aralelemath , Intune VPN profile is recommended to be used which can include the DNS suffix and NRPT. But if you want to use xml based profile, we can try the following OMA-URI OMA-URI : VPNv2/<ProfileName>/ProfileXML Data Type: String (XML file) For the file, we can edit the Native profile example with our value. To add multiple DNS suffix, we can use comma to separate DNS suffixes. <DnsSuffix>corp.contoso.com,hello123.com</DnsSuffix> To add NRPT, we can edit the <DomainNameInformation> part. example in xml <DomainNameInformation> <DomainName>hrsite.corporate.contoso.com</DomainName> <DnsServers>1.2.3.4,5.6.7.8</DnsServers> <WebProxyServers>5.5.5.5</WebProxyServers> <AutoTrigger>true</AutoTrigger> </DomainNameInformation> <DomainNameInformation> <DomainName>.corp.contoso.com</DomainName> <DnsServers>10.10.10.10,20.20.20.20</DnsServers> <WebProxyServers>100.100.100.100</WebProxyServers> </DomainNameInformation> To set always on, we can set change the value to True in the example <AlwaysOn>True</AlwaysOn> https://learn.microsoft.com/en-us/windows/client-management/mdm/vpnv2-profile-xsd#native-profile-example Hope it can help. If the response is helpful, please click "Accept Answer" and upvote it. Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Does AOVPN XML based Profile has all capabilities as Intune VPN profile

Accepted answer

Crystal-MSFT 42,631 Reputation points Microsoft Vendor

2020-09-28T07:11:04.343+00:00

@Mahesh Aralelemath , Intune VPN profile is recommended to be used which can include the DNS suffix and NRPT. But if you want to use xml based profile, we can try the following OMA-URI
OMA-URI : VPNv2/<ProfileName>/ProfileXML
Data Type: String (XML file)

For the file, we can edit the Native profile example with our value. To add multiple DNS suffix, we can use comma to separate DNS suffixes.
<DnsSuffix>corp.contoso.com,hello123.com</DnsSuffix>

To add NRPT, we can edit the <DomainNameInformation> part.

example in xml
<DomainNameInformation>
<DomainName>hrsite.corporate.contoso.com</DomainName>
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
<WebProxyServers>5.5.5.5</WebProxyServers>
<AutoTrigger>true</AutoTrigger>
</DomainNameInformation>
<DomainNameInformation>
<DomainName>.corp.contoso.com</DomainName>
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
<WebProxyServers>100.100.100.100</WebProxyServers>
</DomainNameInformation>

To set always on, we can set change the value to True in the example <AlwaysOn>True</AlwaysOn>
https://learn.microsoft.com/en-us/windows/client-management/mdm/vpnv2-profile-xsd#native-profile-example

Hope it can help.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Mahesh Aralelemath 386 Reputation points

2020-09-28T07:32:59.167+00:00

Hi Crystal,

Somehow not clear, could you pls direct me to sample XML file to include multiple DNS Name in DNS Suffix/DNS Search List and Persistent NRPT pls...

Regards
Mahesh

Crystal-MSFT 42,631 Reputation points Microsoft Vendor

2020-09-28T09:15:20.113+00:00

@Mahesh Aralelemath , With the character limitation , I have updated my reply in the first Answer to read it better..

Mahesh Aralelemath 386 Reputation points

2020-09-28T09:55:34.397+00:00

@Crystal-MSFT
Thanks for the details. I would like to share something below

DNS Suffix syntax as you suggested is already tried.

<DnsSuffix>domain1</DnsSuffix>
<DnsSuffix>domain2/DnsSuffix>

When we try to add multiple DNS domains like above, only last line (<DnsSuffix>domain2/DnsSuffix>) is taking in to consideration. This means "domain2" only added as DNS Suffix.

From below, hope we can only include DomainName and DNSServers? Do not want to include "WebProxy Servers" actually.
example in xml
<DomainNameInformation>
<DomainName>hrsite.corporate.contoso.com</DomainName>
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
</DomainNameInformation>

Regards
Mahesh

Crystal-MSFT 42,631 Reputation points Microsoft Vendor

2020-09-29T04:43:32.603+00:00

@Mahesh Aralelemath , Thanks for the reply. To add multiple DNS suffix, I have tested in the environment. And find it is successful to use comma to separate DNS suffixes. here is an example I tested for the reference:
example:
<DnsSuffix>corp.contoso.com,hello123.com</DnsSuffix>

For the <DomainNameInformation>, yes, it's ok. We can only include DomainName and DnsServers. We can see the example i the following link:
https://learn.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections

Hope it can help.

Mahesh Aralelemath 386 Reputation points

2020-10-02T09:14:29.42+00:00

@Crystal-MSFT

Thanks for your support in testing and confirming for DNS Suffix. This really helped.
We did the testing in our environment and found its working now.

Also would like to share below article on NRPT if this helps anyone in future.
https://directaccess.richardhicks.com/2018/04/23/always-on-vpn-and-the-name-resolution-policy-table-nrpt/

Regards
Mahesh

Crystal-MSFT 42,631 Reputation points Microsoft Vendor

2020-10-06T02:37:06.877+00:00

@Mahesh Aralelemath , Thanks for the sharing. I am glad to hear that our information can help. If there's anything else we can help in the future, feel free to post in our Q&A. We are always glad to help.

Thanks for your time and have a nice day.
Sign in to comment

Does AOVPN XML based Profile has all capabilities as Intune VPN profile

0 additional answers