Manage secure access to resources in spoke VNets for User VPN clients
This article shows you how to use Virtual WAN and Azure Firewall rules and filters to manage secure access for connections to your resources in Azure over point-to site IKEv2 or Open VPN connections. This configuration is helpful if you have remote users for whom you want to restrict access to Azure resources, or to secure your resources in Azure.
The steps in this article help you create the architecture in the following diagram to allow User VPN clients to access a specific resource (VM1) in a spoke VNet connected to the virtual hub, but not other resources (VM2). Use this architecture example as a basic guideline.
You have an Azure subscription. If you don't have an Azure subscription, create a free account.
You have a virtual network that you want to connect to.
- Verify that none of the subnets of your on-premises networks overlap with the virtual networks that you want to connect to.
- To create a virtual network in the Azure portal, see the Quickstart article.
Your virtual network must not have any existing virtual network gateways.
- If your virtual network already has gateways (VPN or ExpressRoute), you must remove all of the gateways before proceeding.
- This configuration requires that virtual networks connect to the Virtual WAN hub gateway only.
Decide the IP address range that you want to use for your virtual hub private address space. This information is used when configuring your virtual hub. A virtual hub is a virtual network that is created and used by Virtual WAN. It's the core of your Virtual WAN network in a region. The address space range must conform the certain rules:
- The address range that you specify for the hub can't overlap with any of the existing virtual networks that you connect to.
- The address range can't overlap with the on-premises address ranges that you connect to.
- If you are unfamiliar with the IP address ranges located in your on-premises network configuration, coordinate with someone who can provide those details for you.
- You have the values available for the authentication configuration that you want to use. For example, a RADIUS server, Azure Active Directory authentication, or Generate and export certificates.
Create a virtual WAN
In the portal, in the Search resources bar, type Virtual WAN in the search box and select Enter.
Select Virtual WANs from the results. On the Virtual WANs page, select + Create to open the Create WAN page.
On the Create WAN page, on the Basics tab, fill in the fields. Modify the example values to apply to your environment.
- Subscription: Select the subscription that you want to use.
- Resource group: Create new or use existing.
- Resource group location: Choose a resource location from the dropdown. A WAN is a global resource and does not live in a particular region. However, you must select a region in order to manage and locate the WAN resource that you create.
- Name: Type the Name that you want to call your virtual WAN.
- Type: Basic or Standard. Select Standard. If you select Basic, understand that Basic virtual WANs can only contain Basic hubs. Basic hubs can only be used for site-to-site connections.
After you finish filling out the fields, at the bottom of the page, select Review +Create.
Once validation passes, click Create to create the virtual WAN.
The point-to-site (P2S) configuration defines the parameters for connecting remote clients. This section helps you define P2S configuration parameters, and then create the configuration that will be used for the VPN client profile. The instructions you follow depend on the authentication method you want to use.
When selecting the authentication method, you have three choices. Each method has specific requirements. Select one of the following methods, and then complete the steps.
Azure Active Directory authentication: Obtain the following:
- The Application ID of the Azure VPN Enterprise Application registered in your Azure AD tenant.
- The Issuer. Example:
- The Azure AD tenant. Example:
Radius-based authentication: Obtain the Radius server IP, Radius server secret, and certificate information.
Azure certificates: For this configuration, certificates are required. You need to either generate or obtain certificates. A client certificate is required for each client. Additionally, the root certificate information (public key) needs to be uploaded. For more information about the required certificates, see Generate and export certificates.
Navigate to the virtual WAN that you created.
Select User VPN configurations from the menu on the left.
On the User VPN configurations page, select +Create user VPN config.
On the Create new User VPN configuration page Basics tab, under Instance details, enter the Name you want to assign to your VPN configuration.
For Tunnel type, select the tunnel type that you want from the dropdown. The tunnel type options are: IKEv2 VPN, OpenVPN, and OpenVpn and IKEv2. Each tunnel type has different required settings.
Requirements and parameters:
Requirements: When you select the IKEv2 tunnel type, you see a message directing you to select an authentication method. For IKEv2, you may specify only one authentication method. You can choose Azure Certificate, Azure Active Directory, or RADIUS-based authentication.
IPSec custom parameters: To customize the parameters for IKE Phase 1 and IKE Phase 2, toggle the IPsec switch to Custom and select the parameter values. For more information about customizable parameters, see the Custom IPsec article.
- Requirements: When you select the OpenVPN tunnel type, you see a message directing you to select an authentication mechanism. If OpenVPN is selected as the tunnel type, you may specify multiple authentication methods. You can choose any subset of Azure Certificate, Azure Active Directory, or RADIUS-based authentication. For RADIUS-based authentication, you can provide a secondary RADIUS server IP address and server secret.
Configure the Authentication methods you want to use. Each authentication method is in a separate tab: Azure certificate, RADIUS authentication, and Azure Active Directory. Some authentication methods are only available on certain tunnel types.
On the tab for the authentication method you want to configure, select Yes to reveal the available configuration settings.
Example - Certificate authentication
Example - RADIUS authentication
Example - Azure Active Directory authentication
When you have finished configuring the settings, click Review + create at the bottom of the page.
Click Create to create the User VPN configuration.
Create the hub and gateway
In this section, you create the virtual hub with a point-to-site gateway. When configuring, you can use the following example values:
- Hub private IP address space: 10.0.0.0/24
- Client address pool: 10.5.0.0/16
- Custom DNS Servers: You can list up to 5 DNS Servers
On the page for your virtual WAN, on the left pane, select Hubs. On the Hubs page, select +New Hub.
On the Create virtual hub page, view the Basics tab.
On the Basics tab, configure the following settings:
- Region: Select the region in which you want to deploy the virtual hub.
- Name: The name by which you want the virtual hub to be known.
- Hub private address space: The hub's address range in CIDR notation.
Click the Point to site tab to open the configuration page for point-to-site. To view the point to site settings, click Yes.
Configure the following settings:
- Gateway scale units - This represents the aggregate capacity of the User VPN gateway. If you select 40 or more gateway scale units, plan your client address pool accordingly. For information about how this setting impacts the client address pool, see About client address pools. For information about gateway scale units, see the FAQ.
- Point to site configuration - Select the User VPN configuration that you created in a previous step.
- Routing preference - Azure routing preference enables you to choose how your traffic routes between Azure and the Internet. You can choose to route traffic either via the Microsoft network, or, via the ISP network (public internet). These options are also referred to as cold potato routing and hot potato routing, respectively. The public IP address in Virtual WAN is assigned by the service based on the routing option selected. For more information about routing preference via Microsoft network or ISP, see the Routing preference article.
- Client address pool - The address pool from which IP addresses will be automatically assigned to VPN clients. For more information, see About client address pools.
- Custom DNS Servers - The IP address of the DNS server(s) the clients will use. You can specify up to 5.
Select Review + create to validate your settings.
When validation passes, select Create. Creating a hub can take 30 minutes or more to complete.
Generate VPN client configuration files
In this section, you generate and download the configuration profile files. These files are used to configure the native VPN client on the client computer. For information about the contents of the client profile files, see Point-to-site configuration - certificates.
On the page for your virtual WAN, select User VPN configurations.
On the User VPN configurations page, select a configuration, then select Download virtual WAN user VPN profile.
When you download the WAN-level configuration, you get a built-in Traffic Manager-based User VPN profile.
For information about Global profiles and hub-based profiles, see Hub profiles. Failover scenarios are simplified with global profile.
If for some reason a hub is unavailable, the built-in traffic management provided by the service ensures connectivity (via a different hub) to Azure resources for point-to-site users. You can always download a hub-specific VPN configuration by navigating to the hub. Under User VPN (point to site), download the virtual hub User VPN profile.
On the Download virtual WAN user VPN profile page, select the Authentication type you want, then click Generate and download profile.
A profile package (zip file) containing the client configuration settings is generated and downloads to your computer.
Configure VPN clients
Use the downloaded profile to configure the remote access clients. The procedure for each operating system is different, follow the instructions that apply to your system.
- Configure an OpenVPN client for Azure Virtual WAN
- Azure AD authentication - Windows 10
- Azure AD authentication - macOS
Select the VPN client configuration files that correspond to the architecture of the Windows computer. For a 64-bit processor architecture, choose the 'VpnClientSetupAmd64' installer package. For a 32-bit processor architecture, choose the 'VpnClientSetupX86' installer package.
Double-click the package to install it. If you see a SmartScreen popup, select More info, then Run anyway.
On the client computer, navigate to Network Settings and select VPN. The VPN connection shows the name of the virtual network that it connects to.
Before you attempt to connect, verify that you have installed a client certificate on the client computer. A client certificate is required for authentication when using the native Azure certificate authentication type. For more information about generating certificates, see Generate Certificates. For information about how to install a client certificate, see Install a client certificate.
Connect the spoke VNet
In this section, you create a connection between your hub and the spoke VNet.
Navigate to your Virtual WAN.
Select Virtual network connections.
On the virtual network connection page, select +Add connection.
On the Add connection page, configure the required settings. For more information about routing settings, see About routing.
- Connection name: Name your connection.
- Hubs: Select the hub you want to associate with this connection.
- Subscription: Verify the subscription.
- Resource group: The resource group that contains the VNet.
- Virtual network: Select the virtual network you want to connect to this hub. The virtual network you select can't have an already existing virtual network gateway.
- Propagate to none: This is set to No by default. Changing the switch to Yes makes the configuration options for Propagate to Route Tables and Propagate to labels unavailable for configuration.
- Associate Route Table: You can select the route table that you want to associate.
- Static routes: You can use this setting to specify next hop.
Once you have completed the settings you want to configure, select Create to create the connection.
Create virtual machines
In this section, you create two VMs in your VNet, VM1 and VM2. In the network diagram, we use 10.18.0.4 and 10.18.0.5. When configuring your VMs, make sure to select the virtual network that you created (found on the Networking tab). For steps to create a VM, see Quickstart: Create a VM.
Secure the virtual hub
A standard virtual hub has no built-in security policies to protect the resources in spoke virtual networks. A secured virtual hub uses Azure Firewall or a third-party provider to manage incoming and outgoing traffic to protect your resources in Azure.
Convert the hub to a secured hub using the following article: Configure Azure Firewall in a Virtual WAN hub.
Create rules that dictate the behavior of Azure Firewall. By securing the hub, we ensure that all packets that enter the virtual hub are subject to firewall processing before accessing your Azure resources.
Once you complete these steps, you will have created an architecture that allows VPN users to access the VM with private IP address 10.18.0.4, but NOT access the VM with private IP address 10.18.0.5
In the Azure portal, navigate to Firewall Manager.
Under Security, select Azure Firewall policies.
Select Create Azure Firewall Policy.
Under Policy details, type in a name and select the region your virtual hub is deployed in.
Select Next: DNS Settings (preview).
Select Next: Rules.
On the Rules tab, select Add a rule collection.
Provide a name for the collection. Set the type as Network. Add a priority value 100.
Fill in the name of the rule, source type, source, protocol, destination ports, and destination type, as shown in the example below. Then, select add. This rule allows any IP address from the VPN client pool to access the VM with private IP address 10.18.04, but not any other resource connected to the virtual hub. Create any rules you want that fit your desired architecture and permissions rules.
Select Next: Threat intelligence.
Select Next: Hubs.
On the Hubs tab, select Associate virtual hubs.
Select the virtual hub you created earlier, and then select Add.
Select Review + create.
It can take 5 minutes or more for this process to complete.
Route traffic through Azure Firewall
In this section, you need to ensure that the traffic is routed through Azure Firewall.
- In the portal, from Firewall Manager, select Secured virtual hubs.
- Select the virtual hub you created.
- Under Settings, select Security configuration.
- Under Private traffic, select Send via Azure Firewall.
- Verify that the VNet connection and the Branch connection private traffic is secured by Azure Firewall.
- Select Save.
Verify the setup of your secured hub.
- Connect to the Secured Virtual Hub via VPN from your client device.
- Ping the IP address 10.18.0.4 from your client. You should see a response.
- Ping the IP address 10.18.0.5 from your client. You should not be able to see a response.
- Make sure that the Effective Routes Table on the secured virtual hub has the next hop for private traffic by the firewall. To access the Effective Routes Table, navigate to your Virtual Hub resource. Under Connectivity, select Routing, and then select Effective Routes. From there, select the Default Route table.
- Verify that you created rules in the Create Rules section. If these steps are missed, the rules you created will not actually be associated to the hub and the route table and packet flow will not use Azure Firewall.