Create a P2S User VPN connection using Azure Virtual WAN - Microsoft Entra authentication
Article
This article shows you how to use Virtual WAN to connect to your resources in Azure. In this article, you create a point-to-site User VPN connection to Virtual WAN that uses Microsoft Entra authentication. Microsoft Entra authentication is only available for gateways that use the OpenVPN protocol.
Note
Microsoft Entra ID authentication is supported only for OpenVPN® protocol connections and requires the Azure VPN Client.
In this article, you learn how to:
Create a virtual WAN
Create a User VPN configuration
Download a virtual WAN User VPN profile
Create a virtual hub
Edit a hub to add P2S gateway
Connect a VNet to a virtual hub
Download and apply the User VPN client configuration
View your virtual WAN
Before you begin
Verify that you've met the following criteria before beginning your configuration:
You have a virtual network that you want to connect to. Verify that none of the subnets of your on-premises networks overlap with the virtual networks that you want to connect to. To create a virtual network in the Azure portal, see the Quickstart.
Your virtual network doesn't have any virtual network gateways. If your virtual network has a gateway (either VPN or ExpressRoute), you must remove all gateways. This configuration requires that virtual networks are connected instead, to the Virtual WAN hub gateway.
Obtain an IP address range for your hub region. The hub is a virtual network that is created and used by Virtual WAN. The address range that you specify for the hub can't overlap with any of your existing virtual networks that you connect to. It also can't overlap with your address ranges that you connect to on premises. If you're unfamiliar with the IP address ranges located in your on-premises network configuration, coordinate with someone who can provide those details for you.
If you don't have an Azure subscription, create a free account.
Create a virtual WAN
From a browser, navigate to the Azure portal and sign in with your Azure account.
In the portal, in the Search resources bar, type Virtual WAN in the search box and select Enter.
Select Virtual WANs from the results. On the Virtual WANs page, select + Create to open the Create WAN page.
On the Create WAN page, on the Basics tab, fill in the fields. Modify the example values to apply to your environment.
Subscription: Select the subscription that you want to use.
Resource group: Create new or use existing.
Resource group location: Choose a resource location from the dropdown. A WAN is a global resource and doesn't live in a particular region. However, you must select a region in order to manage and locate the WAN resource that you create.
Name: Type the Name that you want to call your virtual WAN.
Type: Basic or Standard. Select Standard. If you select Basic, understand that Basic virtual WANs can only contain Basic hubs. Basic hubs can only be used for site-to-site connections.
After you finish filling out the fields, at the bottom of the page, select Review +Create.
Once validation passes, click Create to create the virtual WAN.
Create a User VPN configuration
A User VPN configuration defines the parameters for connecting remote clients. It's important to create the User VPN configuration before configuring your virtual hub with P2S settings, as you must specify the User VPN configuration you want to use.
Navigate to your Virtual WAN ->User VPN configurations page and click +Create user VPN config.
On the Basics page, specify the parameters.
Configuration name - Enter the name you want to call your User VPN Configuration.
Tunnel type - Select OpenVPN from the dropdown menu.
Click Microsoft Entra ID to open the page.
Toggle Microsoft Entra ID to Yes and supply the following values based on your tenant details. You can view the necessary values on the Microsoft Entra ID page for Enterprise applications in the portal.
Authentication method - Select Microsoft Entra ID.
Audience - Type the Application ID of the Azure VPN Client Enterprise Application registered in your Microsoft Entra tenant. For values, see: Azure VPN Client Audience values
Microsoft Entra tenant: TenantID for the Microsoft Entra tenant. Make sure there is no / at the end of the Microsoft Entra tenant URL.
Enter https://login.microsoftonline.com/<your Directory Tenant ID> for Azure Public AD
Enter https://login.microsoftonline.us/<your Directory Tenant ID> for Azure Government AD
Enter https://login-us.microsoftonline.de/<your Directory Tenant ID> for Azure Germany AD
Enter https://login.chinacloudapi.cn/<your Directory Tenant ID> for China 21Vianet AD
Click Create to create the User VPN configuration. You'll select this configuration later in the exercise.
Create an empty hub
For this exercise, we create an empty virtual hub in this step and, in the next section, you add a P2S gateway to this hub. However, you can combine these steps and create the hub with the P2S gateway settings all at once. The result is the same either way. After configuring the settings, click Review + create to validate, then Create.
Go to the virtual WAN that you created. On the virtual WAN page left pane, under the Connectivity, select Hubs.
On the Hubs page, select +New Hub to open the Create virtual hub page.
On the Create virtual hub page Basics tab, complete the following fields:
Region: Select the region in which you want to deploy the virtual hub.
Name: The name by which you want the virtual hub to be known.
Hub private address space: The hub's address range in CIDR notation. The minimum address space is /24 to create a hub.
Virtual hub capacity: Select from the dropdown. For more information, see Virtual hub settings.
This section shows you how to add a gateway to an already existing virtual hub. This step can take up to 30 minutes for the hub to complete updating.
Navigate to the Hubs page under the virtual WAN.
Click the name of the hub that you want to edit to open the page for the hub.
Click Edit virtual hub at the top of the page to open the Edit virtual hub page.
On the Edit virtual hub page, check the checkboxes for Include vpn gateway for vpn sites and Include point-to-site gateway to reveal the settings. Then configure the values.
Gateway scale units: Select the Gateway scale units. Scale units represent the aggregate capacity of the User VPN gateway. If you select 40 or more gateway scale units, plan your client address pool accordingly. For information about how this setting impacts the client address pool, see About client address pools. For information about gateway scale units, see the FAQ.
User VPN configuration: Select the configuration that you created earlier.
After configuring the settings, click Confirm to update the hub. It can take up to 30 minutes to update a hub.
Connect VNet to hub
In this section, you create a connection between your virtual hub and your VNet.
In the Azure portal, go to your Virtual WAN In the left pane, select Virtual network connections.
On the Virtual network connections page, select + Add connection.
On the Add connection page, configure the connection settings. For information about routing settings, see About routing.
Connection name: Name your connection.
Hubs: Select the hub you want to associate with this connection.
Subscription: Verify the subscription.
Resource group: Select the resource group that contains the virtual network to which you want to connect.
Virtual network: Select the virtual network you want to connect to this hub. The virtual network you select can't have an already existing virtual network gateway.
Propagate to none: This is set to No by default. Changing the switch to Yes makes the configuration options for Propagate to Route Tables and Propagate to labels unavailable for configuration.
Associate Route Table: From the dropdown, you can select a route table that you want to associate.
Propagate to labels: Labels are a logical group of route tables. For this setting, select from the dropdown.
Static routes: Configure static routes, if necessary. Configure static routes for Network Virtual Appliances (if applicable). Virtual WAN supports a single next hop IP for static route in a virtual network connection. For example, if you have a separate virtual appliance for ingress and egress traffic flows, it would be best to have the virtual appliances in separate VNets and attach the VNets to the virtual hub.
Bypass Next Hop IP for workloads within this VNet: This setting lets you deploy NVAs and other workloads into the same VNet without forcing all the traffic through the NVA. This setting can only be configured when you're configuring a new connection. If you want to use this setting for a connection you've already created, delete the connection, then add a new connection.
Propagate static route: This setting is currently being rolled out. This setting lets you propagate static routes defined in the Static routes section to route tables specified in Propagate to Route Tables. Additionally, routes will be propagated to route tables that have labels specified as Propagate to labels. These routes can be propagated inter-hub, except for the default route 0/0. This feature is in the process of rolling out. If you need this feature enabled please open a support case
Once you've completed the settings you want to configure, click Create to create the connection.
Download User VPN profile
All of the necessary configuration settings for the VPN clients are contained in a VPN client configuration zip file. The settings in the zip file help you easily configure the VPN clients. The VPN client configuration files that you generate are specific to the User VPN configuration for your gateway. You can download global (WAN-level) profiles, or a profile for a specific hub. For information and additional instructions, see Download global and hub profiles. The following steps walk you through downloading a global WAN-level profile.
To generate a WAN-level global profile VPN client configuration package, go to the virtual WAN (not the virtual hub).
In the left pane, select User VPN configurations.
Select the configuration for which you want to download the profile. If you have multiple hubs assigned to the same profile, expand the profile to show the hubs, then select one of the hubs that uses the profile.
Select Download virtual WAN user VPN profile.
On the download page, select EAPTLS, then Generate and download profile. A profile package (zip file) containing the client configuration settings is generated and downloads to your computer. The contents of the package depend on the authentication and tunnel choices for your configuration.
Configure User VPN clients
Each computer that connects must have a client installed. You configure each client by using the VPN User client profile files that you downloaded in the previous steps. Use the article that pertains to the operating system that you want to connect.
Install directly, when signed in on a client computer: Microsoft Store.
Install the Azure VPN Client to each computer.
Verify that the Azure VPN Client has permission to run in the background. For steps, see Windows background apps.
To verify the installed client version, open the Azure VPN Client. Go to the bottom of the client and click ... -> ? Help. In the right pane, you can see the client version number.
To import a VPN client profile (Windows)
On the page, select Import.
Browse to the profile xml file and select it. With the file selected, select Open.
Specify the name of the profile and select Save.
Select Connect to connect to the VPN.
Once connected, the icon will turn green and say Connected.
To delete a client profile - Windows
Select the ellipsis (...) next to the client profile that you want to delete. Then, select Remove.
Select Remove to delete.
Diagnose connection issues - Windows
To diagnose connection issues, you can use the Diagnose tool. Select the ellipsis (...) next to the VPN connection that you want to diagnose to reveal the menu. Then select Diagnose.
On the Connection Properties page, select Run Diagnosis.
Sign in with your credentials.
View the diagnosis results.
View your virtual WAN
Navigate to the virtual WAN.
On the Overview page, each point on the map represents a hub.
In the Hubs and connections section, you can view hub status, site, region, VPN connection status, and bytes in and out.
Clean up resources
When you no longer need the resources that you created, delete them. Some of the Virtual WAN resources must be deleted in a certain order due to dependencies. Deleting can take about 30 minutes to complete.
Open the virtual WAN that you created.
Select a virtual hub associated to the virtual WAN to open the hub page.
Delete all gateway entities following the below order for each gateway type. This can take 30 minutes to complete.
VPN:
Disconnect VPN sites
Delete VPN connections
Delete VPN gateways
ExpressRoute:
Delete ExpressRoute connections
Delete ExpressRoute gateways
Repeat for all hubs associated to the virtual WAN.
You can either delete the hubs at this point, or delete the hubs later when you delete the resource group.
Navigate to the resource group in the Azure portal.
Select Delete resource group. This deletes the other resources in the resource group, including the hubs and the virtual WAN.
Next steps
For Virtual WAN frequently asked questions, see the Virtual WAN FAQ.
You learn how to design and implement hybrid networking solutions such as Site-to-Site VPN connections, Point-to-Site VPN connections, Azure Virtual WAN, and Virtual WAN hubs.