VPN access

Question

VPN access

Fahad Ahmed 1

My company wants to deploy azure vpn to connect on premise sites together. We have achieved this goal in a test environment. Problem is, one site has different subnets. We want to set this up so that a few employees have access to one subnet and restrict access for the other subnet. I see that currently azure does have the ability to assign static ip to vpn clients. Has anyone faced similar requirements? Any suggestions on how we can move forward with this?

All help would be greatly appreciated. Thank you.

SaiKishor-MSFT 17,341 Reputation points Moderator

2021-08-24T11:12:14.563+00:00

@Fahad Ahmed Are you using Azure Point to Site VPN or Azure Site to Site VPN?
Fahad Ahmed 1 Reputation point

2021-08-24T14:25:55.74+00:00

I have configured a site to site vpn from azure to one of the on prem locations. i then created a point to site vpn for users to connect to azure. Currently, users can access both networks ion the on prem location using the vpn. I want some users to access one network and other users to access the second network.

Thank you for your response.
Fahad Ahmed 1 Reputation point

2021-08-24T14:30:54.29+00:00

We do not have any resources in azure in this case that the clients need to connect to. We are just using the vpn service in azure for now.
SaiKishor-MSFT 17,341 Reputation points Moderator

2021-08-25T14:31:24.393+00:00

@Fahad Ahmed Just to clarify, when you talk about users, are you referring to Azure P2S VPN users? If so, do they access the on-premise via Azure P2S VPN and then S2S VPN? If possible, please share a network diagram.

In regard to assigning a static IP to P2S users, this is not possible at the moment.
Fahad Ahmed 1 Reputation point

2021-08-25T16:10:12.523+00:00

These users are in our Azure AD. The users connect to azure via P2S VPN. Then Azure is connected to on-premise via S2S. The users DO NOT connect to on-premise directly. They connect to azure using P2S and then are able to access resources in on-premise since on-premise is connected to azure via S2S.

I just need a way that allows me to block one subnet from selected users.

I do not have a network diagram available.
SaiKishor-MSFT 17,341 Reputation points Moderator

2021-08-27T07:33:44.597+00:00

@Fahad Ahmed Based on your requirement, I think it is best to add custom routes to the VPN Profiles of the clients that need to be restricted. You can add only the routes for the subnets that they can connect to. Here is how you can add/block routes from the VPN client.

Hope this helps. Please let us know if you have further questions/concerns. Thank you!