Configure a point-to-site (P2S) VPN on Windows for use with Azure Files

In order to set up a point-to-site VPN using the Azure portal, you'll need to know your resource group name, virtual network name, gateway subnet name, and storage account name.

Run this script to collect the necessary information. Replace <resource-group>, <vnet-name>, <subnet-name>, and <storage-account-name> with the appropriate values for your environment.

$resourceGroupName  = '<resource-group-name>'
$virtualNetworkName = '<vnet-name>'
$subnetName         = '<subnet-name>'
$storageAccountName = '<storage-account-name>'

$virtualNetworkParams = @{
    ResourceGroupName = $resourceGroupName
    Name              = $virtualNetworkName
}
$virtualNetwork = Get-AzVirtualNetwork @virtualNetworkParams

$subnetId = $virtualNetwork |
    Select-Object -ExpandProperty Subnets |
    Where-Object {$_.Name -eq 'StorageAccountSubnet'} |
    Select-Object -ExpandProperty Id

$storageAccountParams = @{
    ResourceGroupName = $resourceGroupName
    Name              = $storageAccountName
}
$storageAccount = Get-AzStorageAccount @storageAccountParams

$privateEndpoint = Get-AzPrivateEndpoint |
    Where-Object {
        $subnets = $_ |
            Select-Object -ExpandProperty Subnet |
            Where-Object {$_.Id -eq $subnetId}

        $connections = $_ |
            Select-Object -ExpandProperty PrivateLinkServiceConnections |
            Where-Object {$_.PrivateLinkServiceId -eq $storageAccount.Id}
        
        $null -ne $subnets -and $null -ne $connections
    } |
    Select-Object -First 1

To deploy a virtual network gateway using the Azure portal, follow these instructions.

1. Sign in to the Azure portal.

2. In Search resources, services, and docs, type virtual network gateways. Locate Virtual network gateways in the Marketplace search results and select it.

3. Select + Create to create a new virtual network gateway.

4. On the Basics tab, fill in the values for Project details and Instance details.

   

   • Subscription: Select the subscription you want to use from the dropdown.
   • Resource Group: This setting is autofilled when you select your virtual network on this page.
   • Name: Name your gateway. Naming your gateway not the same as naming a gateway subnet. It's the name of the gateway object you're creating.
   • Region: Select the region in which you want to create this resource. The region for the gateway must be the same as the virtual network.
   • Gateway type: Select VPN. VPN gateways use the virtual network gateway type VPN.
   • SKU: Select the gateway SKU that supports the features you want to use from the dropdown. See Gateway SKUs. Don't use the Basic SKU because it doesn't support IKEv2 authentication.
   • Generation: Select the generation you want to use. We recommend using a Generation2 SKU. For more information, see Gateway SKUs.
   • Virtual network: From the dropdown, select the virtual network to which you want to add this gateway. If you can't see the virtual network for which you want to create a gateway, make sure you selected the correct subscription and region.
   • Subnet: This field should be grayed out and list the name of the gateway subnet you created, along with its IP address range. If you instead see a Gateway subnet address range field with a text box, then you haven't yet configured a gateway subnet (see Prerequisites.)

5. Specify the values for the Public IP address that gets associated to the virtual network gateway. The public IP address is assigned to this object when the virtual network gateway is created. The only time the primary public IP address changes is when the gateway is deleted and re-created. It doesn't change across resizing, resetting, or other internal maintenance/upgrades.

   

   • Public IP address: Leave Create new selected.
   • Public IP address name: In the text box, type a name for your public IP address instance.
   • Public IP address SKU: Setting is autoselected.
   • Assignment: The assignment is typically autoselected and can be either Dynamic or Static.
   • Enable active-active mode: Select Disabled. Only enable this setting if you're creating an active-active gateway configuration.
   • Configure BGP: Select Disabled, unless your configuration specifically requires this setting. If you do require this setting, the default ASN is 65515, although this value can be changed.

6. Select Review + create to run validation. Once validation passes, select Create to deploy the virtual network gateway. Deployment can take up to 45 minutes to complete.

7. When deployment is complete, select Go to resource.

8. In the service menu, under Settings, select Point-to-site configuration and then select Configure now. You should see the Point-to-site configuration page.

   

   • Address pool: Add the private IP address range that you want to use. VPN clients dynamically receive an IP address from the range that you specify. The minimum subnet mask is 29 bit for active/passive and 28 bit for active/active configuration.
   • Tunnel type: Specify the tunnel type you want to use. Computers connecting via the native Windows VPN client will try IKEv2 first. If that doesn't connect, they fall back to SSTP (if you select both IKEv2 and SSTP from the dropdown). If you select the OpenVPN tunnel type, you can connect using an OpenVPN Client or the Azure VPN Client.
   • Authentication type: Specify the authentication type you want to use (in this case, choose Azure certificate).
   • Root certificate name: The file name of the root certificate (.cer file).
   • Public certificate data: Open the root certificate with NotePad and copy/paste the public certificate data in this text field. If you used the PowerShell script in this article to generate a self-signed root certificate, it will be located in C:\vpn-temp. Be sure to only paste the text that's in between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Don't include any additional spaces or characters.

   Note

   If you don't see tunnel type or authentication type, your gateway is using the Basic SKU. The Basic SKU doesn't support IKEv2 authentication. If you want to use IKEv2, you need to delete and recreate the gateway using a different gateway SKU.

9. Select Save at the top of the page to save all of the configuration settings and upload the root certificate public key information to Azure.

Replace <desired-vpn-name> and <desired-region> in the following script with the proper values for these variables.

While this resource is being deployed, this PowerShell script will block the deployment from being completed. This is expected.

$vpnName             = '<desired-vpn-name>' 
$publicIpAddressName = "$vpnName-PublicIP"
$region              = '<desired-region>'

$publicIpParams = @{
    ResourceGroupName = $resourceGroupName
    Name              = $publicIpAddressName
    Location          = $region
    Sku               = 'Basic'
    AllocationMethod  = 'Dynamic'
}
$publicIpAddress = New-AzPublicIpAddress @publicIPParams

$gatewayIpParams = @{
    Name = 'vnetGatewayConfig'
    SubnetId = $subnetId
    PublicIpAddressId = $publicIPAddress.Id
}
$gatewayIpConfig = New-AzVirtualNetworkGatewayIpConfig @gatewayIpParams

$vpnClientRootCertParams = @{
    Name           = 'P2SRootCert'
    PublicCertData = $rootCertificate
}
$azRootCertificate = New-AzVpnClientRootCertificate @vpnClientRootCertParams

$virtualNetGatewayParams = @{
    ResourceGroupName         = $resourceGroupName
    Name                      = $vpnName
    Location                  = $region
    GatewaySku                = 'VpnGw2'
    IpConfigurations          = $gatewayIpConfig
    GatewayType               = 'Vpn'
    VpnType                   = 'RouteBased'
    IpConfigurations          = $gatewayIpConfig
    VpnClientAddressPool      = '172.16.201.0/24'
    VpnClientProtocol         = 'IkeV2'
    VpnClientRootCertificates = $azRootCertificate
}
$vpn = New-AzVirtualNetworkGateway @virtualNetGatewayParams

Install the client certificate

To install the client certificate required for authentication against the virtual network gateway, follow these steps on the client computer.

1. Once the client certificate is exported, locate and copy the .pfx file to the client computer.
2. On the client computer, double-click the .pfx file to install. Leave the Store Location as Current User, and then select Next.
3. On the File to import page, don't make any changes. Select Next.
4. On the Private key protection page, input the password for the certificate, or verify that the security principal is correct, then select Next.
5. On the Certificate Store page, leave the default location, and then select Next.
6. Select Finish. On the Security Warning for the certificate installation, select Yes. You can comfortably select 'Yes' for this security warning because you generated the certificate.
7. The certificate is now successfully imported.

Install the VPN client

This section helps you configure the native VPN client that's part of your Windows operating system to connect to your virtual network (IKEv2 and SSTP). This configuration doesn't require additional client software.

View configuration files

On the client computer, navigate to C:\vpn-temp and open the vpnclientconfiguration folder to view the following subfolders:

• WindowsAmd64 and WindowsX86, which contain the Windows 64-bit and 32-bit installer packages, respectively. The WindowsAmd64 installer package is for all supported 64-bit Windows clients, not just Amd.
• Generic, which contains general information used to create your own VPN client configuration. The Generic folder is provided if IKEv2 or SSTP+IKEv2 was configured on the gateway. If only SSTP is configured, then the Generic folder isn't present.

Configure VPN client profile

You can use the same VPN client configuration package on each Windows client computer, as long as the version matches the architecture for the client.

1. Select the VPN client configuration files that correspond to the architecture of the Windows computer. For a 64-bit processor architecture, choose the VpnClientSetupAmd64 installer package. For a 32-bit processor architecture, choose the VpnClientSetupX86 installer package.

2. Double-click the package to install it. If you see a SmartScreen popup, select More info, then Run anyway.

3. Connect to your VPN. Go to VPN Settings and locate the VPN connection that you created. It's the same name as your virtual network. Select Connect. A pop-up message might appear. Select Continue to use elevated privileges.

4. On the Connection status page, select Connect to start the connection. If you see a Select Certificate screen, verify that the client certificate showing is the one that you want to use to connect. If it isn't, use the drop-down arrow to select the correct certificate, and then select OK.

The following PowerShell script will install the client certificate required for authentication against the virtual network gateway, and then download and install the VPN package. Remember to replace <computer1> and <computer2> with the desired computers. You can run this script on as many machines as you desire by adding more PowerShell sessions to the $sessions array. Your user account must be an administrator on each of these machines. If one of these machines is the local machine you're running the script from, you must run the script from an elevated PowerShell session.

$sessions = [System.Management.Automation.Runspaces.PSSession[]]@()
$sessions += New-PSSession -ComputerName '<computer1>'
$sessions += New-PSSession -ComputerName '<computer2>'

foreach ($session in $sessions) {
    Invoke-Command -Session $session -ArgumentList $vpnTemp -ScriptBlock { 
        $vpnTemp = $args[0]
        if (-Not (Test-Path -Path $vpnTemp -PathType Container)) {
            New-Item -ItemType Directory -Force -Path 'C:\vpn-temp' | Out-Null
        }
    }

    $copyItemParams = @{
        Path        = @(
            $exportedclientcertpath,
            $exportedrootcertpath,
            "$vpnTemp\vpnclientconfiguration.zip"
        )
        Destination = $vpnTemp
        ToSession   = $session
    }
    Copy-Item @copyItemParams

    $invokeCmdParams = @{
        Session = $session
        ArgumentList = @($mypwd, $vpnTemp, $virtualNetworkName)
    }
    Invoke-Command @invokeCmdParams -ScriptBlock { 
        $mypwd              = $args[0] 
        $vpnTemp            = $args[1]
        $virtualNetworkName = $args[2]
        
        $pfxCertParams = @{
            Exportable        = $true
            Password          = $mypwd
            CertStoreLocation = 'Cert:\LocalMachine\My'
            FilePath          = "$vpnTemp\P2SClientCert.pfx" 
        }
        Import-PfxCertificate @pfxCertParams | Out-Null
        
        $importCertParams = @{
            FilePath          = "$vpnTemp\P2SRootCert.cer"
            CertStoreLocation = "Cert:\LocalMachine\Root"
        }
        Import-Certificate @importCertParams | Out-Null

        $vpnGenericParams = @{
            Path            = "$vpnTemp\vpnclientconfiguration.zip"
            DestinationPath = "$vpnTemp\vpnclientconfiguration"
        }
        Expand-Archive @vpnGenericParams

        $vpnGeneric = "$vpnTemp\vpnclientconfiguration\Generic"

        $vpnProfile = ([xml](Get-Content -Path "$vpnGeneric\VpnSettings.xml")).VpnProfile

        $vpnConnectionParams = @{
            Name                 = $virtualNetworkName
            ServerAddress        = $vpnProfile.VpnServer
            TunnelType           = 'Ikev2'
            EncryptionLevel      = 'Required'
            AuthenticationMethod = 'MachineCertificate'
            SplitTunneling       = $true
            AllUserConnection    = $true
        }
        Add-VpnConnection @vpnConnectionParams

        $vpnConnRoute1Params = @{
            Name              = $virtualNetworkName
            DestinationPrefix = $vpnProfile.Routes
            AllUserConnection = $true
        }
        Add-VpnConnectionRoute @vpnConnRoute1Params

        $vpnConnRoute2Params = @{
            Name              = $virtualNetworkName
            DestinationPrefix = $vpnProfile.VpnClientAddressPool
            AllUserConnection = $true
        }
        Add-VpnConnectionRoute @vpnConnRoute2Params

        rasdial $virtualNetworkName
    }
}

Remove-Item -Path $vpnTemp -Recurse

To mount the file share using your storage account key, open a Windows command prompt and run the following command. Replace�<YourStorageAccountName>, <FileShareName>, and <YourStorageAccountKey> with your own values. If Z: is already in use, replace it with an available drive letter. You can find your storage account key in the Azure portal by navigating to the storage account and selecting Security + networking > Access keys.

net use Z: \\<YourStorageAccountName>.file.core.chinacloudapi.cn\<FileShareName> /user:localhost\<YourStorageAccountName> <YourStorageAccountKey>

The following PowerShell script will mount the share, list the root directory of the share to prove the share is actually mounted, and then unmount the share.

$myShareToMount = '<file-share>'

$storageAccountKeyParams = @{
    ResourceGroupName = $resourceGroupName
    Name              = $storageAccountName
}
$storageAccountKeys = Get-AzStorageAccountKey @storageAccountKeyParams

$convertToSecureStringParams = @{
    String = $storageAccountKeys[0].Value
    AsPlainText = $true
    Force = $true
}
$storageAccountKey = ConvertTo-SecureString @convertToSecureStringParams

$getAzNetworkInterfaceParams = @{
    ResourceId = $privateEndpoint.NetworkInterfaces[0].Id
}
$nic = Get-AzNetworkInterface @getAzNetworkInterfaceParams

$storageAccountPrivateIP = $nic.IpConfigurations[0].PrivateIpAddress

$invokeCmdParams = @{
    Session = $sessions
    ArgumentList = @(
        $storageAccountName,
        $storageAccountKey,
        $storageAccountPrivateIP,
        $myShareToMount
    )
}
Invoke-Command @invokeCmdParams -ScriptBlock {
    $storageAccountName      = $args[0]
    $storageAccountKey       = $args[1]
    $storageAccountPrivateIP = $args[2]
    $myShareToMount          = $args[3]

    $credential = [System.Management.Automation.PSCredential]::new(
        "AZURE\$storageAccountName", 
        $storageAccountKey
    )

    $psDriveParams = @{
        Name       = 'Z'
        PSProvider = 'FileSystem'
        Root       = "\\$storageAccountPrivateIP\$myShareToMount"
        Credential = $credential
        Persist    = $true
    }
    New-PSDrive @psDriveParams | Out-Null

    Get-ChildItem -Path Z:\
    Remove-PSDrive -Name Z
}