How to set up an azure vpn gateway from a remote user laptop to an Azure VM

Question

Hi.
I am trying to set up vpn access from a remote user's laptop to an Azure VM.

I am attempting to configure the vpn gateway to use point to site (I don't see anything point to point) with the "site" being the resource group that the VM is in. (is there any way to do this point to point, as in remote laptop to 1 Azure VM?)

I tried to set this up using Azure AD authentication, but I don't know the answer to the "audience" or "issuer" question. I am ultimately wanting to have a secure RDP session to the VM's desktop application.

What is the best way to do this? I have looked at the documentation but don't see the answers I am looking for.

Any help would be appreciated!

Thanks in advance!
Sharyn

Answer 1

Hello @Anonymous ,

Thank you for the update.

For better clarity, I have provided the step-by-step instructions with screenshots on how to enable Point to Site with OpenVPN + Azure AD Authentication:

Step 1 - Create or Verify you have a Global Admin account:

Your Azure AD tenant needs the following accounts: a Global Admin account and a user account.
If you do not have Global Administrator account, please create one by following below:

Navigate to Azure Portal : https://portal.azure.com/ --> Search “Azure Active Directory” --> Click on Users --> New User
Add the new user to the subscription with owner access.

Step 2 - Get Azure AD Directory ID that you want to use for authentication:
Navigate to Azure Portal : https://portal.azure.com/ --> Search “Azure Active Directory” --> Properties (Make a note of the Directory ID).

Step 3 - Register the App which will be authorized for Azure AD authentication.
Open Incognito Windows --> Navigate to Azure Portal : https://portal.azure.com/ --> Sign-in with the newly created Global Admin Account.

URL where you need to sign in : https://login.microsoftonline.com/common/oauth2/authorize?client_id=41b23e61-6c1e-4545-b367-cd054e0ed4b4&response_type=code&redirect_uri=https://portal.azure.com&nonce=1234&prompt=admin_consent

NOTE : If you using a global admin account that is not native to the Azure AD tenant to provide consent, please replace “common” with the Azure AD directory id in the above URL. You may also have to replace “common” with your directory id in certain other cases as well.

Native member to Azure AD tenant is a member user or Azure AD member whose account is created via Azure AD > Users > Create user option in the tenant.
A user not native to the Azure AD tenant means a user who is brought over from another directory as a business-to-business (B2B) collaboration guest (guest user).

Select Accept when prompted.

Step 4 - Create a VNET and a VPN gateway (Route Based) if you don’t have any existing VNET\Gateway. If you already have a VPN gateway, skip to next step.

Step 5 - Enable Azure AD authentication on the VPN gateway:

To enable Azure AD authentication on the VPN gateway navigate to VPN gateway -> Point-to-site configuration and add below details:

• Client address pool: Add an address space - VPN clients that connect to the VNet using this Point-to-Site connection receive an IP address from the client address pool.
• Select OpenVPN (SSL) as the Tunnel type.
• Select Azure Active Directory as the Authentication type,
• Then fill in the information under the Azure Active Directory section as below:
• Tenant: TenantID for the Azure AD tenant : https://login.microsoftonline.com/{AzureAD TenantID}/
• Audience: Application ID of the "Azure VPN" Azure AD Enterprise App : 41b23e61-6c1e-4545-b367-cd054e0ed4b4
• Issuer: URL of the Secure Token Service : https://sts.windows.net/{AzureAD TenantID}/

NOTE : Replace your Tenant ID above where it says AzureAD TenantID. Make sure you include a trailing slash at the end of the AadIssuerUri value. Otherwise, the connection may fail.

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant#enable-authentication
You can find the Tenant, Audience and Issuer values in the step 9 of the above doc and they are provided to you for all Azure clouds. I believe you are using Azure Public cloud and hence I have added the Public cloud values in my step.

Step 6 - Download the VPN Client profile & extract the VPN Client Package.
Navigate to Azure Portal : https://portal.azure.com/ --> go to your VPN gateway --> select Point-to-site configuration --> At the top of the Point-to-site configuration page, select Download VPN client. It takes a few minutes for the client configuration package to generate.

Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/about-vpn-profile-download

Step 7 - Download and Install Azure VPN Client from Microsoft Store :

Browse to Microsoft store - https://www.microsoft.com/en-us/p/azure-vpn-client/9np355qt2sqb#activetab=pivot:overviewtab and get the Azure VPN client.

Step 8 - Configure Azure VPN Client :
Open the installed Azure VPN Client --> Click on Import --> Navigate to the VPNclientConfiguration extracted folder (refer step6)
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client#import

To manually add the VPN profile, you can use the VpnSettings.xml file extracted in step 6 to get the required information such as Audience, Issuer, Tenant, FQDN & ServerSecret.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client#connection
After filling out the values, select Save.

Step 9 - Connect to P2S VPN.
Select Connect on the Azure VPN client to connect to the VPN.
Select the proper credentials (Azure AD account) to sign-in.
Once successfully connected, the icon will turn green and say Connected.

Additional Information:
Now, coming to your question of why you need another address space in the point to site configuration when you already have added a GatewaySubnet, please find the answer below:

Gateway subnet address range: This field only appears if your VNet doesn't have a gateway subnet. It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway. We don't recommend creating a range any smaller than /28. If you already have a gateway subnet, you can view GatewaySubnet details by navigating to your virtual network. Select Subnets to view the range. If you want to change the range, you can delete and recreate the GatewaySubnet. So, while you can create a gateway subnet as small as /29, we recommend that you create a gateway subnet of /27 or larger (/27, /26, /25 etc.).
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-vpn-faq#do-i-need-a-gatewaysubnet

P2S VPN Client address pool: The client address pool is a range of private IP addresses that you specify in your P2S VPN configuration. The clients that connect over a Point-to-Site VPN dynamically receive an IP address from this range. Use a private IP address range that does not overlap with the on-premises location that you connect from, or the VNet that you want to connect to. VPN clients dynamically receive an IP address from the range that you specify. The minimum subnet mask is 29 bit for active/passive and 28 bit for active/active configuration.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello @Anonymous ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are trying to setup an Azure point to site VPN with Azure AD authentication and need help in finding the "audience" and "issuer" information to configure the VPN profile.

Please validate if you have already created the Azure AD tenant for P2S connections and enabled Azure AD authentication on the VPN gateway following the below article:
https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

Post that you configure a VPN client to connect to a virtual network using Point-to-Site VPN and Azure Active Directory authentication with OpenVPN protocol, you need to download the Azure VPN Client and configure a VPN client profile on every computer that wants to connect to the VNet.
Refer : https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client

You can generate & download client configuration files using PowerShell, or by using the Azure portal. In the downloaded AzureVPN folder, the azurevpnconfig.xml file contains information that is necessary to configure a VPN connection such as Audience, Issuer, Tenant, FQDN & ServerSecret etc.
How to generate and download VPN profile : https://learn.microsoft.com/en-us/azure/vpn-gateway/about-vpn-profile-download

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.