Azure VPN Setup

Question

Azure VPN Setup

SACHER Patrick 20

Hi! We have an Azure VPN Setup where our users can connect to the resources from the onprem side. In our Azure Setup we have several site2site connections to customers. I want to control which users have access to the different tunnels. For example UserA connects to our Azure VPN. UserA has access over the tunnel to customerA but not to customerB or customerC. Is this possible in general? Regards!

Marcin Policht 68,300 Reputation points MVP Volunteer Moderator

2024-02-22T17:49:38.4333333+00:00

You can do this for P2S VPN - as described in https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant , but not for S2S VPN

hth Marcin
SACHER Patrick 20 Reputation points

2024-02-23T07:21:08.5266667+00:00

Thanks for the awnser!
Okay so if i understand it right: User A is at our main office. Main office has a s2s to our azure resources. Then User A would need a P2S connection to every customer instead of a s2s tunnel yeah? What if our office would have a p2s connection to our azure vpn. Can users then further connect with an additional p2s connection to a specific customer? Regards
SACHER Patrick 20 Reputation points

2024-02-23T07:25:43.98+00:00

Thank you for the awnser! If i understand it right: UserA is at our main office. main office has a s2s to our azure vpn. User A would then need all different P2S setups for each customer right? What if our office would have a p2s connection to our azure vpn. Can users then further connect with an additional p2s connection to a specific customer? Regards

Answer accepted by question author

0 additional answers

Your answer

Marcin Policht 68,300 Reputation points MVP Volunteer Moderator

2024-02-22T17:49:38.4333333+00:00

You can do this for P2S VPN - as described in https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant , but not for S2S VPN

hth Marcin
SACHER Patrick 20 Reputation points

2024-02-23T07:21:08.5266667+00:00

Thanks for the awnser!
Okay so if i understand it right: User A is at our main office. Main office has a s2s to our azure resources. Then User A would need a P2S connection to every customer instead of a s2s tunnel yeah? What if our office would have a p2s connection to our azure vpn. Can users then further connect with an additional p2s connection to a specific customer? Regards
SACHER Patrick 20 Reputation points

2024-02-23T07:25:43.98+00:00

Thank you for the awnser! If i understand it right: UserA is at our main office. main office has a s2s to our azure vpn. User A would then need all different P2S setups for each customer right? What if our office would have a p2s connection to our azure vpn. Can users then further connect with an additional p2s connection to a specific customer? Regards

Answer 1

TP 145.5K Volunteer Moderator

Hi Patrick,

For your requirement it may be simpler to use one of the third-party solutions available in Azure Marketplace. One example, with OpenVPN Access Server you can control which subnets/IP addresses each user can access. I grabbed below diagram off of their site. It shows different access for various IPs, but could easily be for different customer subnets:

qna openvpn access server custom auth

In this way you could have each user connect to the Access Server in Azure from the main office using their Entra ID credentials, and then they would be able to access whichever customer IP ranges or individual customer IPs you granted them access to. Please note there are other third-party options that provide similar functionality. If you have a preferred network security virtual appliance vendor that you use it is likely they have offering in Azure Marketplace too.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

SACHER Patrick 20 Reputation points

2024-02-23T09:31:28.8066667+00:00

thank you for you great awnser!
Yes this is exactly what i needed. Just for clarification - This is not Possible with the Azure VPN Service alone? Regards
TP 145.5K Reputation points Volunteer Moderator

2024-02-23T09:58:40.7166667+00:00

No, Azure VPN Gateway doesn't have ability to control which subnets/IPs each user/group can connect to.

Share via

Azure VPN Setup

0 additional answers

Your answer