Cisco Meraki to Azure AAD DS

Jason 96 Reputation points
2021-02-19T21:54:51.47+00:00

I am new(ish) to Azure networking and could use some input / direction.

Goal: I have a small network of VMs in a datacenter that I would like to join to my Azure Active Directory Domain Services.

Current Setup:

datacenter: Meraki MX84 acting as firewall, VM setup as DNS server for local network

Azure:

resource group:
vnet1
address space: 172.16.0.0/16
subnet: default - 172.16.0.0/24
subnet: gateway - 172.16.1.0/24
Gateway
Site-to-site VPN to datacenter meraki (actively connected successfully)

AAD DS with IPs: 172.16.0.4 & 172.16.0.5 attached to subnet default with a NSG with default rules from Azure.

S2S VPN is setup and connected between Meraki MX84 and above Azure gateway.

I can't get any of the datacenter VMs to talk to the AAD DS.

When I created the VPN on the Meraki side, the Meraki auto created a route in it's route table of 172.16.1.0/24 through the VPN.

Any help would be much appreciated.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,314 questions
0 comments
Accepted answer
  1. Jason 96 Reputation points
    2021-02-25T03:04:07.72+00:00

    Thanks again for your responses. I got the VPN tunnel working correctly by adding a route table in Azure to the Gateway and AAD DS subnets.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva-kumar-selvaraj 15,546 Reputation points
    2021-02-23T09:45:35.417+00:00

    Hello @Jason ,

    Thanks for reaching out.

    You can use Azure ADDS to manage your on-premise workstations provided you have a Site-to-Site VPN connection between on-prem and Azure.

    Since there are many components involved in this scenario, so just to isolate the issue, I would recommend you to create a new test VM in the same VNet where Azure ADDS is provision and see Azure VM can talk to the AAD DS without any issue? if doesn't work then we need to fix that in first place.

    As you design the virtual network for Azure AD DS, the following considerations apply:

    • Azure AD DS must be deployed into the same Azure region as your virtual network. Make sure that you create or select a virtual network in a region that supports Azure AD DS.
    • Use a VPN gateway to create a secure tunnel using IPsec/IKE. This connection model lets you deploy the managed domain into an Azure virtual network and then connect on-premises locations or other clouds.

    For more information,read Azure virtual network design and Using virtual private networking, Configure a (Site-to-Site (IPsec) by using the Azure portal.

    ------------------------------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.