2. Secure Socket Tunneling Protocol (SSTP<\/strong>) is a TLS-based VPN protocol that is proprietary. Because most firewalls open TCP port 443 outbound, which TLS uses, a TLS VPN solution can pass through them. Only Windows devices are compatible with SSTP. All versions of Windows with SSTP and TLS 1.2 support are supported by Azure (Windows 8.1 and later).<\/p>\n 3. IKEv2 VPN<\/strong> is an IPsec VPN solution based on standards. From a Mac device, you can connect to an IKEv2 VPN (macOS versions 10.11 and above).<\/p>\n Follow below steps to create VNet in Azure:<\/p>\n 1:<\/strong> Firstly, you must sign into the Azure portal and then search for Virtual Network.<\/p>\n 2:<\/strong> Secondly, choose Virtual Network from Azure MarketPlace and then click on the create button.<\/p>\n 3:<\/strong> The Create virtual network page will appear after you select Create. Now, configure the Project details and Instance details VNet settings on the Basics tab.<\/p>\n 4:<\/strong> In the IP provide the IPv4 address range and subnet.<\/p>\n 5:<\/strong> In the security tab leave it as default.<\/p>\n 6:<\/strong> Provide appropriate tags<\/p>\n 7:<\/strong> Once last review all the settings and then hit on the create button.<\/p>\n A VPN gateway is a type of virtual network gateway that sends encrypted traffic over the public Internet between an Azure virtual network and an on-premises location. There can only be one VPN gateway in every virtual network.<\/p>\n A subnet known as the gateway subnet is used by the virtual network gateway. The virtual network IP address range you specify when configuring your virtual network includes the gateway subnet. It contains the IP addresses for the resources and services of the virtual network gateway.<\/p>\n Follow the below steps to create VPN Gateway in Azure:<\/p>\n 1:<\/strong> Firstly, search for Virtual Networks Gateway in the search box and then choose it from Azure MarketPlace. And, then hit on the create button.<\/p>\n 2:<\/strong> In the basics section one must fill all the values.<\/p>\n 3:<\/strong> In the tags provide appropriate tags that you can remember<\/p>\n 4:<\/strong> Review all the details and once the validation is passed click on the create button.<\/p>\n Note:<\/strong> Users should make a note that the deployment of the virtual network gateway might take up to 45 minutes of duration to complete.<\/p>\n Clients connecting to a VNet via a Point-to-Site VPN connection are authenticated using certificates in Azure.<\/p>\n You upload the public key information to Azure after you obtain a root certificate. Azure then considers the root certificate to be ‘trusted,’ allowing P2S to connect to the virtual network.<\/p>\n Client certificates will also be generated from the trusted root certificate and installed on each client computer.<\/p>\n When a client initiates a connection to the VNet, the client certificate is used to authenticate the client.<\/p>\n Generate a self-signed certificate or use a root certificate generated with an enterprise solution (recommended). Export the public certificate data (not the private key) as a Base64 encoded X.509.cer file after creating the root certificate. Then, on the Azure server, upload the public certificate data.<\/p>\n Run the following script in PowerShell as an administrator.<\/p>\n It will create a root cert and install it under the current user cert store.<\/p>\n Now, in the Powershell run the following command:<\/p>\n The following should provide a thumbprint:<\/p>\n Now, run the following command. But, make sure the thumbprint should match your Certificate.<\/p>\n Lastly, enter the following command to generate client certificate<\/p>\n We now have certificates in place, but we need to export the root certificate so that it can be uploaded to Azure.<\/p>\n To begin, export the public key for the root certificate (.cer)<\/p>\n To open the Run dialogue box, press Windows Key + “R” and type “certmgr.msc.” Your newly created certificate should appear in “Current UserPersonalCertificates” when the management console opens. Go to All Tasks > Export by right-clicking on your newly created certificate.<\/p>\n Now click on the Next option in the wizard.<\/p>\n Choose \u201cNo, do not export the private key\u201d and then click on the Next button.<\/p>\n On the Export File Format page, choose Base-64 encoded X.509 (.CER)., and then click on the Next button.<\/p>\n For File to Export, Browse and select a location to where you want to export the certificate then provide a file name. And, click Next.<\/p>\n Finally, click on the finish button and you will see the certificate on the saved location.<\/p>\n The point-to-site connection will be configured next in this configuration. We’ll also define the pool of client IP addresses here. It’s for VPN clients.<\/p>\n 1. Select the newly created VPN gateway connection by clicking on it.<\/p>\n 2. Then click Point-to-Site Configuration in a new window.<\/p>\n 3. Select Configure Now.<\/p>\n 4. Type the VPN address pool’s IP address range in a new window. 20.20.20.0\/24 will be used. Use both SSTP and IKEv2 for tunnelling. By default, IKEv2 is used to connect Linux and other mobile clients. In Windows, IKEv2 is used first, followed by SSTP. Use Azure Certificates for authentication.<\/p>\n 5. There is a place to define a root certificate in the same window. Type the cert name in the root certificate name field, and paste the root certificate data in the public certificate data field ( you can open cert in notepad to get data).<\/p>\n 6. Then, to finish the process, click Save.<\/p>\n Note<\/strong>: Do not copy the text \u2014\u2013BEGIN CERTIFICATE\u2014\u2013 and \u2014\u2013END CERTIFICATE\u2014\u2013 when pasting certificate data.<\/p>\n From the machine, go to the VPN gateway configuration page in the Azure portal and follow below steps:<\/p>\n 1:<\/strong> Select Point-to-Site Configuration from the drop-down menu.<\/p>\n 2:<\/strong> Then, select Download VPN Client from the drop-down menu.<\/p>\n <\/p>\n 3:<\/strong> After downloading, extract or unzip the file and then double click on the VPN client setup.<\/p>\n 4:<\/strong> Just allow the installation and after that, you will see a new connection under the windows 10 VPN page.<\/p>\n 5:<\/strong> Now, click on connect option in VPN.<\/p>\n 6:<\/strong> Now, a new window will appear on the screen and click on the Connect option.<\/p>\nHow to create VNet in Azure?<\/h3>\n
![\"searching](\"https:\/\/data-flair.training\/blogs\/wp-content\/uploads\/sites\/2\/2022\/03\/searching-virtual-network.webp\")
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nCreating Azure VPN Gateway<\/h3>\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nGenerating Certificates in Azure<\/h3>\n
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `\r\n-Subject \u201cCN=SLP2SRootCert\u201d -KeyExportPolicy Exportable `\r\n-HashAlgorithm sha256 -KeyLength 2048 `\r\n-CertStoreLocation \u201cCert:\\CurrentUser\\My\u201d -KeyUsageProperty Sign -KeyUsage CertSign\r\n<\/pre>\n
<\/a><\/p>\nGenerate Client Certificates from Root Certificate in Azure<\/h3>\n
Get-ChildItem -Path \u201cCert:\\CurrentUser\\My\u201d<\/pre>\n
<\/a><\/p>\n$cert = Get-ChildItem -Path \u201cCert:\\CurrentUser\\My\\ 0FD6775DA36A288CC91EAC1702167112765B8F05\r\n<\/pre>\n
New-SelfSignedCertificate -Type Custom -KeySpec Signature `\r\n-Subject \u201cCN=SLP2SClientCert\u201d -KeyExportPolicy Exportable -NotAfter (Get-Date).AddYears(1) `\r\n-HashAlgorithm sha256 -KeyLength 2048 `\r\n-CertStoreLocation \u201cCert:\\CurrentUser\\My\u201d `\r\n-Signer $cert -TextExtension @(\u201c2.5.29.37={text}1.3.6.1.5.5.7.3.2\u201d)\r\n<\/pre>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\nConfiguring Point to Site Connection in Azure<\/h3>\n
<\/a><\/p>\nTesting VPN Connection<\/h3>\n
<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n<\/a><\/p>\n