[How To] Establish a Point-to-Site VPN connection between Azure and a client

In this guide, we will go over setting up a Point-to-Site VPN connection that will allow an on-premise virtual machine talk to a resource/VM that is hosted in Microsoft Azure.  In this guide, we will take advantage of the new Preview Portal for this guide.

  1. Login to the Microsoft Azure Preview Portal
    1. https://portal.azure.com/
  2. Create a VNET
    1. Click on the + New button
      Azure - New button
    2. Select Networking, Virtual NetworkAzure - Create - Networking - Virtual Networking
    3. Type in a Name for your VNET
      Azure - Create - Networking - Virtual Networking - Name
    4. Select Address Space, configure the parameters of your cloud based virtual network, and click OK
      Azure - Create - Networking - Virtual Networking - Address space
    5. Select Resource Group, Create a new resource group, enter a name for the group and click OK
      Azure - Create - Networking - Virtual Networking - Resource Group - Create resource group
    6. Click Location and select the location closest to you
      Azure - Create - Networking - Virtual Networking - Location - East US 2
    7. Click Create
      Azure - Create - Networking - Virtual Networking - Virtual Network - Create
  3. With the Virtual Network blade still open, select VPN connections
    Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections
  4. On the New VPN Connection blade, select Point-to-site, in the Address Spaces prompts, enter in each of your subnets, ensure Create gateway immediately is checked and then click on Subnet, size and routing type
    Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections - New VPN Connection
  5. Select Subnet on the Gateway configuration blade
    Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections - Gateway configuration
  6. Enter in a new subnet that will be used for clients connecting through the VPN tunnel and then click OK
    Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections - Gateway configuration - Add subnet
  7. Click OK on the Gateway configuration blade
    Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections - Gateway configuration w Subnet
  8. Click OK on the New VPN Connection blade
  9. If you refresh the Azure portal, you should now see on the VPN connections section that it is trying to create the gateway.  Based on my experience, this process can take awhile to setup (10-15 minutes), so this is something you will want to provision and then get up and grab a cup of coffee
    1. In the process of provisioning
      Azure - VPN Connections - Creating the gateway
    2. Provisioned gateway
      Azure - VPN Connections - Gateway created
  10. Generate and upload certificates
    1. Generate a self-signed SSL certificate via command prompt
      1. You can use whatever utility you are most comfortable with; I'd recommend using makecert if you have Visual Studio installed (can be found here: C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\x64).  If you don't have Visual Studio, you can use openSSL
      2. Using Visual Studio's command prompt
        1. Execute the following command to generate a root certificate
          1. makecert -sky exchange -r -n "CN=AzureVLANRootCertificate" -pe -a sha1 -len 2048 -ss My "AzureVLANRootCertificate.cer"
        2. Execute the following command to generate a client certificate
          1. makecert.exe -n "CN=AzureVLANClientCertificate" -pe -sky exchange -m 96 -ss My -in "AzureVLANRootCertificate" -is my -a sha1
        3. Notes: The root certificate and client certificate can have whatever name you wish, just ensure that in the client certificate, the root certificate's name matches the root certificate you just generated
  11. Upload your root certificate
    1. On the Virtual Network blade, click on VPN Connections
      Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned
    2. Click on Point-to-siteAzure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned - VPN connections - Point-to-Site
    3. Click on Manage Certificate
      Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned - VPN connections - Point-to-Site - Manage Certificate
    4. Click on Upload
      Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned - VPN connections - Point-to-Site - Manage Certificate - Upload
    5. Select your certificate and click OK
      Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned - VPN connections - Point-to-Site - Manage Certificate - Upload - Certificate
  12. Establish a connection
    1. Go back to the Point-to-site connection blade and select the VPN Client for your supported OS
      Azure - Create - Networking - Virtual Networking - Virtual Network - VPN Connections Provisioned - VPN connections - Point-to-Site - VPN Client 64-bit
    2. Save and Run the VPN installer
      Azure - Save - Point-to-site VPN
    3. Install the VPN Client by clicking on Yes
      Azure - Save - Point-to-site VPN - Install
    4. Connect to Azure via the VPN connection
      Windows 8 - Networks - CloudVNET
    5. Click Connect on the VPN dialog
      Windows 8 - Networks - CloudVNET - CloudVNET
    6. Click Continue to temporarily add routes to Azure while the VPN connection is established
      Windows 8 - Networks - CloudVNET - CloudVNET Routes
  13. Verify you are connected via the Point-to-site connections blade
    Azure - Networking - Point-to-site VPN connection established

At this point, this specific client that is connected to Azure should have access to all internal devices on the Server's subnet we created in step 2-4! 🙂

Notes:

Official MSDN information can be found here: https://msdn.microsoft.com/en-us/library/azure/dn133792.aspx

2 thoughts on “[How To] Establish a Point-to-Site VPN connection between Azure and a client

  1. Grant Rosenthal

    Hi Jack,

    Thanks for this info, a great step through guide. It seems the portal has changed somewhat and theVPN is not showing up in the way shown above. Has this changed with the latest updates to the portal?

    Thanks
    Grant

    Reply
    1. Jack Post author

      Hey Grant,

      Yes, the portal has changed quite a bit! What you are running into the ARM vs ASM. If you go through and select Virtual Network (Classic), these steps will be very similar. If you select Virtual Networks, the changes are quite different. To do this in the new portal, look for Virtual Network Gateways, and then select + Add on the Virtual Networks Blade.

      On this page, type in a name for the gateway and select your existing VNET. At this point, it will go out and provision the gateway. The last step is to add a connection back to your on-prem environment.

      Hope this helps!
      Jack

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *