How to secure On-Premises Windows server by joining them to Azure AD

Question

How to secure On-Premises Windows server by joining them to Azure AD

Pouya Panahy 1

We have a set of Windows servers on an On-prem network (172.0.0.0/24)
They use Azure VPN, like our laptops do, to connect to Azure resources we have. Our azure vpn gateway provides an ip in the range of 192.168.0.0/24 and it has only a P2S connection.
This azure gateway is connected to our Azure VNet using a subnet: 10.0.2.0/24
The servers on the on-prem network are not connected to any domain.

We want to secure the connection to those servers by joining them to our Azure AD. This brought us to the idea to use Azure AD Domain Services. this aadds connects to our only VNet using a subnet 10.0.15.0/24 and has 2 ip numbers .4 and .5

Having all this done looks like our applications can access on-prem servers but; other way arround, the servers can not access internal resources like aadds to connect to! Seems like 10.0.15.4 and 10.0.15.5 are not reachable from on-prem network.

Is the direction I am going even possible? Or should I have a better solution?
why is my azure adds ip's not reachable?

1 answer

Your answer

Answer 1

Alan Kinane 16,951 MVP Volunteer Moderator

Hi, firstly let's not confuse Azure AD Domain Services (AAD DS) with Azure AD. These are two different services. AAD DS is a managed domain service which provides some features of traditional Active Directory but without the requirement to manage and maintain underlying virtual machines. Azure AD is a completely separate service to this.

You say the IP addresses are not reachable, how are you trying to connect? You will not be able to RDP to those IP addresses but you should be able to contact them to do a domain join or ping for example.

Did you say you are connecting via P2S connection only? If so you would need to make sure that all of the VNET routes are published in the VPN configuration file so if you have recently added the AAD DS environment then make sure to download the Azure VPN configuration from the portal again to get all of the available routes included in the configuration.

Pouya Panahy 1 Reputation point

2021-11-17T16:01:16.737+00:00

Thanks for clearing up the distinction between those resources on AZURE
I tried first using LDP.exe but could not reach the AAD DS so I tried to ping them and still no success. Then I made a VM in that subnet which can join to AAD DS but I can not even ping that vm server.
It is interesting point to download the latest Azure VPN configuration from the portal.
I have not done that yet.

After connecting the servers to AAD DS domain I want to give permissions to Azure AD users to access those servers. That is why the title is called to Azure AD.
Pouya Panahy 1 Reputation point

2021-11-17T16:29:10.687+00:00

downloading the new configuration of Azure VPN did not change anything on my access to those ip numbers
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2021-11-17T17:06:50.42+00:00

That's very strange that you can't access from the same subnet. I presume you don't have any deny rules on a network security group that would block this? It might be worth testing this with the IP Flow tool in Network Watcher - https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview
Pouya Panahy 1 Reputation point

2021-11-17T17:32:27.717+00:00

They are not on the same subnet. Gateway has 2 subnets: one for VPN connections 192.168.0.0/24 and one to connect to our VNet where AAD DS also connect 10.0.2.0/24
So, the server have 192 ip and wants to connect to another subnet 10

I have no deny rules and have only Allow rules to let the resources from Azure go to On-Prem machines

I like the Network Watcher tool, comes very handy. Thanks to mention it.
Alan Kinane 16,951 Reputation points MVP Volunteer Moderator

2021-11-17T17:47:04.827+00:00

Then I made a VM in that subnet which can join to AAD DS but I can not even ping that vm server.

This is what puzzles me the most. This should definitely work unless you have put NSG rules in to block it or else have you put some user definite routes in place that prevent routing over the subnet directly? I wonder if there is an Issue with the AAD DS service itself, perhaps you could delete and redeploy it if you are not using it currently.

Share via

How to secure On-Premises Windows server by joining them to Azure AD

1 answer

Your answer