Transition to OpenVPN protocol or IKEv2 from SSTP

A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This article applies to the Resource Manager deployment model and talks about ways to overcome the 128 concurrent connection limit of SSTP by transitioning to OpenVPN protocol or IKEv2.

What protocol does P2S use?

Point-to-site VPN can use one of the following protocols:

  • OpenVPN® Protocol, an SSL/TLS based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which SSL uses. OpenVPN can be used to connect from Android, iOS (versions 11.0 and above), Windows, Linux and Mac devices (macOS versions 10.13 and above).

  • Secure Socket Tunneling Protocol (SSTP), a proprietary SSL-based VPN protocol. An SSL VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which SSL uses. SSTP is only supported on Windows devices. Azure supports all versions of Windows that have SSTP (Windows 7 and later). SSTP supports up to 128 concurrent connections only regardless of the gateway SKU.

  • IKEv2 VPN, a standards-based IPsec VPN solution. IKEv2 VPN can be used to connect from Mac devices (macOS versions 10.11 and above).

Note

IKEv2 and OpenVPN for P2S are available for the Resource Manager deployment model only. They are not available for the classic deployment model. Basic gateway SKU does not support IKEv2 or OpenVPN protocols. If you are using the basic SKU, you will have to delete and recreate a production SKU Virtual Network Gateway.

Migrating from SSTP to IKEv2 or OpenVPN

There may be cases when you want to support more than 128 concurrent P2S connection to a VPN gateway but are using SSTP. In such a case, you need to move to IKEv2 or OpenVPN protocol.

Option 1 - Add IKEv2 in addition to SSTP on the Gateway

This is the simplest option. SSTP and IKEv2 can coexist on the same gateway and give you a higher number of concurrent connections. You can simply enable IKEv2 on the existing gateway and redownload the client.

Adding IKEv2 to an existing SSTP VPN gateway will not affect existing clients and you can configure them to use IKEv2 in small batches or just configure the new clients to use IKEv2. If a Windows client is configured for both SSTP and IKEv2, it will try to connect using IKEV2 first and if that fails, it will fall back to SSTP.

IKEv2 uses non-standard UDP ports so you need to ensure that these ports are not blocked on the user's firewall. The ports in use are UDP 500 and 4500.

To add IKEv2 to an existing gateway, simply go to the "point-to-site configuration" tab under the Virtual Network Gateway in portal, and select IKEv2 and SSTP (SSL) from the drop-down box.

Screenshot that shows the "Point-to-site configuration" page with the "Tunnel type" drop-down open, and "IKEv2 and SSTP(SSL)" selected.

Option 2 - Remove SSTP and enable OpenVPN on the Gateway

Since SSTP and OpenVPN are both TLS-based protocol, they cannot coexist on the same gateway. If you decide to move away from SSTP to OpenVPN, you will have to disable SSTP and enable OpenVPN on the gateway. This operation will cause the existing clients to lose connectivity to the VPN gateway until the new profile has been configured on the client.

You can enable OpenVPN along side with IKEv2 if you desire. OpenVPN is TLS-based and uses the standard TCP 443 port. To switch to OpenVPN, go to the "point-to-site configuration" tab under the Virtual Network Gateway in portal, and select OpenVPN (SSL) or IKEv2 and OpenVPN (SSL) from the drop-down box.

point-to-site

Once the gateway has been configured, existing clients will not be able to connect until you deploy and configure the OpenVPN Clients.

If you are using Windows 10, you can also use the Azure VPN Client for Windows

Frequently asked questions

What are the client configuration requirements?

Note

For Windows clients, you must have administrator rights on the client device in order to initiate the VPN connection from the client device to Azure.

Users use the native VPN clients on Windows and Mac devices for P2S. Azure provides a VPN client configuration zip file that contains settings required by these native clients to connect to Azure.

  • For Windows devices, the VPN client configuration consists of an installer package that users install on their devices.
  • For Mac devices, it consists of the mobileconfig file that users install on their devices.

The zip file also provides the values of some of the important settings on the Azure side that you can use to create your own profile for these devices. Some of the values include the VPN gateway address, configured tunnel types, routes, and the root certificate for gateway validation.

Note

Starting July 1, 2018, support is being removed for TLS 1.0 and 1.1 from Azure VPN Gateway. VPN Gateway will support only TLS 1.2. Only point-to-site connections are impacted; site-to-site connections will not be affected. If you’re using TLS for point-to-site VPNs on Windows 10 clients, you don’t need to take any action. If you are using TLS for point-to-site connections on Windows 7 and Windows 8 clients, see the VPN Gateway FAQ for update instructions.

Which gateway SKUs support P2S VPN?

VPN
Gateway
Generation
SKU S2S/VNet-to-VNet
Tunnels
P2S
SSTP Connections
P2S
IKEv2/OpenVPN Connections
Aggregate
Throughput Benchmark
BGP Zone-redundant
Generation1 Basic Max. 10 Max. 128 Not Supported 100 Mbps Not Supported No
Generation1 VpnGw1 Max. 30* Max. 128 Max. 250 650 Mbps Supported No
Generation1 VpnGw2 Max. 30* Max. 128 Max. 500 1 Gbps Supported No
Generation1 VpnGw3 Max. 30* Max. 128 Max. 1000 1.25 Gbps Supported No
Generation1 VpnGw1AZ Max. 30* Max. 128 Max. 250 650 Mbps Supported Yes
Generation1 VpnGw2AZ Max. 30* Max. 128 Max. 500 1 Gbps Supported Yes
Generation1 VpnGw3AZ Max. 30* Max. 128 Max. 1000 1.25 Gbps Supported Yes
Generation2 VpnGw2 Max. 30* Max. 128 Max. 500 1.25 Gbps Supported No
Generation2 VpnGw3 Max. 30* Max. 128 Max. 1000 2.5 Gbps Supported No
Generation2 VpnGw4 Max. 30* Max. 128 Max. 5000 5 Gbps Supported No
Generation2 VpnGw5 Max. 30* Max. 128 Max. 10000 10 Gbps Supported No
Generation2 VpnGw2AZ Max. 30* Max. 128 Max. 500 1.25 Gbps Supported Yes
Generation2 VpnGw3AZ Max. 30* Max. 128 Max. 1000 2.5 Gbps Supported Yes
Generation2 VpnGw4AZ Max. 30* Max. 128 Max. 5000 5 Gbps Supported Yes
Generation2 VpnGw5AZ Max. 30* Max. 128 Max. 10000 10 Gbps Supported Yes

(*) Use Virtual WAN if you need more than 30 S2S VPN tunnels.

  • The resizing of VpnGw SKUs is allowed within the same generation, except resizing of the Basic SKU. The Basic SKU is a legacy SKU and has feature limitations. In order to move from Basic to another VpnGw SKU, you must delete the Basic SKU VPN gateway and create a new gateway with the desired Generation and SKU size combination. You can only resize a Basic gateway to another legacy SKU (see Working with Legacy SKUs).

  • These connection limits are separate. For example, you can have 128 SSTP connections and also 250 IKEv2 connections on a VpnGw1 SKU.

  • Pricing information can be found on the Pricing page.

  • SLA (Service Level Agreement) information can be found on the SLA page.

  • On a single tunnel a maximum of 1 Gbps throughput can be achieved. Aggregate Throughput Benchmark in the above table is based on measurements of multiple tunnels aggregated through a single gateway. The Aggregate Throughput Benchmark for a VPN Gateway is S2S + P2S combined. If you have a lot of P2S connections, it can negatively impact a S2S connection due to throughput limitations. The Aggregate Throughput Benchmark is not a guaranteed throughput due to Internet traffic conditions and your application behaviors.

To help our customers understand the relative performance of SKUs using different algorithms, we used publicly available iPerf and CTSTraffic tools to measure performances. The table below lists the results of performance tests for Generation 1, VpnGw SKUs. As you can see, the best performance is obtained when we used GCMAES256 algorithm for both IPsec Encryption and Integrity. We got average performance when using AES256 for IPsec Encryption and SHA256 for Integrity. When we used DES3 for IPsec Encryption and SHA256 for Integrity we got lowest performance.

Generation SKU Algorithms
used
Throughput
observed
Packets per second per tunnel
observed
Generation1 VpnGw1 GCMAES256
AES256 & SHA256
DES3 & SHA256
650 Mbps
500 Mbps
120 Mbps
58,000
50,000
50,000
Generation1 VpnGw2 GCMAES256
AES256 & SHA256
DES3 & SHA256
1 Gbps
500 Mbps
120 Mbps
90,000
80,000
55,000
Generation1 VpnGw3 GCMAES256
AES256 & SHA256
DES3 & SHA256
1.25 Gbps
550 Mbps
120 Mbps
105,000
90,000
60,000
Generation1 VpnGw1AZ GCMAES256
AES256 & SHA256
DES3 & SHA256
650 Mbps
500 Mbps
120 Mbps
58,000
50,000
50,000
Generation1 VpnGw2AZ GCMAES256
AES256 & SHA256
DES3 & SHA256
1 Gbps
500 Mbps
120 Mbps
90,000
80,000
55,000
Generation1 VpnGw3AZ GCMAES256
AES256 & SHA256
DES3 & SHA256
1.25 Gbps
550 Mbps
120 Mbps
105,000
90,000
60,000

Note

The Basic SKU does not support IKEv2 or RADIUS authentication.

What IKE/IPsec policies are configured on VPN gateways for P2S?

IKEv2

Cipher Integrity PRF DH Group
GCM_AES256 GCM_AES256 SHA384 GROUP_24
GCM_AES256 GCM_AES256 SHA384 GROUP_14
GCM_AES256 GCM_AES256 SHA384 GROUP_ECP384
GCM_AES256 GCM_AES256 SHA384 GROUP_ECP256
GCM_AES256 GCM_AES256 SHA256 GROUP_24
GCM_AES256 GCM_AES256 SHA256 GROUP_14
GCM_AES256 GCM_AES256 SHA256 GROUP_ECP384
GCM_AES256 GCM_AES256 SHA256 GROUP_ECP256
AES256 SHA384 SHA384 GROUP_24
AES256 SHA384 SHA384 GROUP_14
AES256 SHA384 SHA384 GROUP_ECP384
AES256 SHA384 SHA384 GROUP_ECP256
AES256 SHA256 SHA256 GROUP_24
AES256 SHA256 SHA256 GROUP_14
AES256 SHA256 SHA256 GROUP_ECP384
AES256 SHA256 SHA256 GROUP_ECP256
AES256 SHA256 SHA256 GROUP_2

IPsec

Cipher Integrity PFS Group
GCM_AES256 GCM_AES256 GROUP_NONE
GCM_AES256 GCM_AES256 GROUP_24
GCM_AES256 GCM_AES256 GROUP_14
GCM_AES256 GCM_AES256 GROUP_ECP384
GCM_AES256 GCM_AES256 GROUP_ECP256
AES256 SHA256 GROUP_NONE
AES256 SHA256 GROUP_24
AES256 SHA256 GROUP_14
AES256 SHA256 GROUP_ECP384
AES256 SHA256 GROUP_ECP256
AES256 SHA1 GROUP_NONE

What TLS policies are configured on VPN gateways for P2S?

TLS

Policies
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256

How do I configure a P2S connection?

A P2S configuration requires quite a few specific steps. The following articles contain the steps to walk you through P2S configuration, and links to configure the VPN client devices:

Next steps

"OpenVPN" is a trademark of OpenVPN Inc.