mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
improved acrolinx scores
This commit is contained in:
Paolo Matarazzo
parent
5bcf431e39
commit
4f14e15b5f
Binary file not shown.
|
Before Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 23 KiB After Width: | Height: | Size: 228 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 55 KiB After Width: | Height: | Size: 176 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB After Width: | Height: | Size: 200 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB After Width: | Height: | Size: 254 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB After Width: | Height: | Size: 168 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB After Width: | Height: | Size: 315 KiB |
@ -1,88 +1,84 @@
|
||||
---
|
||||
title: VPN auto-triggered profile options (Windows 10 and Windows 11)
|
||||
description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource.
|
||||
ms.date: 09/23/2021
|
||||
title: VPN auto-triggered profile options
|
||||
description: With auto-triggered VPN profile options, Windows can automatically establish a VPN connection based on IT admin-defined rules. Learn about the types of auto-trigger rules that you can create for VPN connections.
|
||||
ms.date: 05/24/2023
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN auto-triggered profile options
|
||||
|
||||
In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules:
|
||||
Windows can use different features to auto-trigger VPN, avoiding users to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules:
|
||||
|
||||
- App trigger
|
||||
- Application trigger
|
||||
- Name-based trigger
|
||||
- Always On
|
||||
|
||||
> [!NOTE]
|
||||
> Auto-triggered VPN connections will not work if Folder Redirection for AppData is enabled. Either Folder Redirection for AppData must be disabled or the auto-triggered VPN profile must be deployed in system context, which changes the path to where the rasphone.pbk file is stored.
|
||||
> Auto-triggered VPN connections won't work if **Folder Redirection** for **AppData** is enabled. Either Folder Redirection for AppData must be disabled, or the auto-triggered VPN profile must be deployed in SYSTEM context, which changes the path to where the *rasphone.pbk* file is stored.
|
||||
|
||||
## Application trigger
|
||||
|
||||
## App trigger
|
||||
VPN profiles can be configured to automatically connect on the execution of certain applications:
|
||||
|
||||
VPN profiles in Windows 10 or Windows 11 can be configured to connect automatically on the launch of a specified set of applications. You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection. You can also configure per-app VPN and specify traffic rules for each app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
- You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection
|
||||
- You can configure per-app VPN and specify traffic rules for each app
|
||||
|
||||
The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name.
|
||||
> [!NOTE]
|
||||
> The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name.
|
||||
>
|
||||
> [Find a package family name (PFN) for per-app VPN configuration](/mem/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
|
||||
[Find a package family name (PFN) for per-app VPN configuration](/mem/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
For more information, see [Traffic filters](vpn-security-features.md#traffic-filters).
|
||||
|
||||
## Name-based trigger
|
||||
|
||||
You can configure a domain name-based rule so that a specific domain name triggers the VPN connection.
|
||||
|
||||
Name-based auto-trigger can be configured using the VPNv2/*ProfileName*/DomainNameInformationList/dniRowId/AutoTrigger setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
You can configure a domain name-based rule so that a specific domain name triggers the VPN connection.\
|
||||
Name-based auto-trigger can be configured using the `VPNv2/<ProfileName>/DomainNameInformationList/dniRowId/AutoTrigger` setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
There are four types of name-based triggers:
|
||||
|
||||
- Short name: for example, if **HRweb** is configured as a trigger and the stack sees a DNS resolution request for **HRweb**, the VPN will be triggered.
|
||||
- Fully-qualified domain name (FQDN): for example, if **HRweb.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request for **HRweb.corp.contoso.com**, the VPN will be triggered.
|
||||
- Suffix: for example, if **.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request with a matching suffix (such as **HRweb.corp.contoso.com**), the VPN will be triggered. For any short name resolution, VPN will be triggered and the DNS server will be queried for the *ShortName*.**corp.contoso.com**.
|
||||
- All: if used, all DNS resolution should trigger VPN.
|
||||
|
||||
- Short name: for example, if *HRweb* is configured as a trigger, and the stack sees a DNS resolution request for *HRweb*, the VPN triggers
|
||||
- Fully qualified domain name (FQDN): for example, if *HRweb.corp.contoso.com* is configured as a trigger, and the stack sees a DNS resolution request for *HRweb.corp.contoso.com*, the VPN triggers
|
||||
- Suffix: for example, if *.corp.contoso.com* is configured as a trigger, and the stack sees a DNS resolution request with a matching suffix (such as *HRweb.corp.contoso.com*), the VPN triggers. For any short name resolution, VPN triggers, and the DNS servers are queried for the *<ShortName>.corp.contoso.com*
|
||||
- All: if used, all DNS resolution triggers VPN
|
||||
|
||||
## Always On
|
||||
|
||||
Always On is a feature in Windows 10 and Windows 11 which enables the active VPN profile to connect automatically on the following triggers:
|
||||
Always On is a Windows feature that enables the active VPN profile to connect automatically on the following triggers:
|
||||
|
||||
- User sign-in
|
||||
- Network change
|
||||
- Device screen on
|
||||
- User sign-in
|
||||
- Network change
|
||||
- Device screen on
|
||||
|
||||
When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction.
|
||||
When the trigger occurs, VPN tries to connect. If an error occurs, or any user input is needed, the user sees a toast notification for more interaction.
|
||||
|
||||
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers.
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings > Network & Internet > VPN > <VPN profile>** by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile, and therefore only one user, is able to use the Always On triggers.
|
||||
|
||||
## Preserving user Always On preference
|
||||
|
||||
Windows has a feature to preserve a user's AlwaysOn preference. In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.
|
||||
Another Windows feature is to preserve a user's Always On preference. If a user manually unchecks the **Connect automatically** checkbox, Windows remembers the user preference for the profile name by adding the profile name to the registry value *AutoTriggerDisabledProfilesList*.
|
||||
|
||||
Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference.
|
||||
|
||||
**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config<br/>
|
||||
**Value:** AutoTriggerDisabledProfilesList<br/>
|
||||
**Type:** REG_MULTI_SZ
|
||||
If a management tool removes or adds the same profile name back and set **AlwaysOn** to **true**, Windows doesn't check the box if the profile name exists in the following registry value, in order to preserve user preference.
|
||||
|
||||
**Key:** `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config`\
|
||||
**Value:** `AutoTriggerDisabledProfilesList`\
|
||||
**Type:** `REG_MULTI_SZ`
|
||||
|
||||
## Trusted network detection
|
||||
|
||||
This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffixes. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered.
|
||||
|
||||
Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp).
|
||||
The **Trusted network detection** feature configures the VPN so that connection isn't triggered when a device is on a trusted network. To configure Trusted network detection, you must provide a list of DNS suffixes. The VPN stack verifies the network name of the physical interface connection profile: if it matches any of the suffixes configured in the list and the network is private or provisioned by MDM, then VPN doesn't trigger.
|
||||
|
||||
Trusted network detection can be configured using the `VPNv2/<ProfileName>/TrustedNetworkDetection` setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
## Configure app-triggered VPN
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.
|
||||
The following image shows associating apps to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
:::image type="content" source="images/vpn-app-trigger.png" alt-text="Creation of VPN profile in Intune: application association options." lightbox="images/vpn-app-trigger.png":::
|
||||
|
||||
After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
|
||||
@ -1,15 +1,15 @@
|
||||
---
|
||||
title: Windows VPN technical guide (Windows 10 and Windows 11)
|
||||
description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment.
|
||||
ms.date: 02/21/2022
|
||||
title: Windows VPN technical guide
|
||||
description: Learn how to plan and configure Windows devices for your organization's VPN solution.
|
||||
ms.date: 05/24/2023
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows VPN technical guide
|
||||
|
||||
This guide will walk you through the decisions you will make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10 and Windows 11.
|
||||
This guide walks you through the decisions to make for Windows clients in your organization's VPN solution, and how to configure your devices. This guide references the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp) and provides mobile device management (MDM) configuration instructions using Microsoft Intune.
|
||||
|
||||
To create a Windows 10 VPN device configuration profile see: [Windows 10 and Windows Holographic device settings to add VPN connections using Intune](/mem/intune/configuration/vpn-settings-windows-10).
|
||||
To create a Windows VPN device configuration profile see: [Windows device settings to add VPN connections using Intune](/mem/intune/configuration/vpn-settings-windows-10).
|
||||
|
||||
> [!NOTE]
|
||||
> This guide does not explain server deployment.
|
||||
@ -29,7 +29,6 @@ To create a Windows 10 VPN device configuration profile see: [Windows 10 and Win
|
||||
| [VPN security features](vpn-security-features.md) | Configure traffic filtering, connect a VPN profile to Windows Information Protection (WIP), and more |
|
||||
| [VPN profile options](vpn-profile-options.md) | Combine settings into single VPN profile using XML |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
- [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure)
|
||||
|
||||
@ -1,58 +1,55 @@
|
||||
---
|
||||
title: VPN name resolution (Windows 10 and Windows 11)
|
||||
description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server.
|
||||
ms.date: 09/23/2021
|
||||
title: VPN name resolution
|
||||
description: Learn how name resolution works when using a VPN connection.
|
||||
ms.date: 05/24/2023
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN name resolution
|
||||
|
||||
When the VPN client connects to the VPN server, the VPN client receives the client IP address. The client may also receive the IP address of the Domain Name System (DNS) server and the IP address of the Windows Internet Name Service (WINS) server.
|
||||
When the VPN client establishes a connection, it receives an IP address and, optionally, the IP address of one or more DNS servers.
|
||||
|
||||
The name resolution setting in the VPN profile configures how name resolution should work on the system when VPN is connected. The networking stack first looks at the Name Resolution Policy table (NRPT) for any matches and tries a resolution in the case of a match. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (in the case of a short name) and a DNS query is sent out on the preferred interface. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces.
|
||||
The name resolution setting in the VPN profile determines how name resolution works on the system when the VPN connection is established:
|
||||
|
||||
1. The network stack looks at the Name Resolution Policy table (NRPT) for any matches, and tries a resolution if a match is found
|
||||
1. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (if a short name is used). A DNS query is sent to the preferred interface
|
||||
1. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces
|
||||
|
||||
## Name Resolution Policy table (NRPT)
|
||||
|
||||
The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache.
|
||||
|
||||
There are 3 types of name matches that can set up for NRPT:
|
||||
The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It's the first place that the stack will look after the DNSCache.
|
||||
|
||||
There are three types of name matches that can set up for NRPT:
|
||||
|
||||
- Fully qualified domain name (FQDN) that can be used for direct matching to a name
|
||||
|
||||
- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (in case of a short name)
|
||||
|
||||
- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (if using short name)
|
||||
- Any resolution should attempt to first resolve with the proxy server/DNS server with this entry
|
||||
|
||||
NRPT is set using the **VPNv2/*ProfileName*/DomainNameInformationList** node of the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). This node also configures Web proxy server or domain name servers.
|
||||
NRPT is set using the `VPNv2/<ProfileName>/DomainNameInformationList` node of the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). You can use the same node to configure a Web proxy server or DNS.
|
||||
|
||||
[Learn more about NRPT](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee649207(v=ws.10))
|
||||
To learn more about NRPT, see [Introduction to the NRPT](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee649207(v=ws.10)).
|
||||
|
||||
|
||||
## DNS suffix
|
||||
|
||||
This setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established.
|
||||
|
||||
Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node.
|
||||
|
||||
The DNS suffix setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established.
|
||||
|
||||
Primary DNS suffix is set using the `VPNv2/<ProfileName>/DnsSuffix` node.
|
||||
|
||||
[Learn more about primaryDNS suffix](/previous-versions/windows/it-pro/windows-2000-server/cc959611(v=technet.10))
|
||||
|
||||
## Persistent
|
||||
|
||||
You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN.
|
||||
|
||||
Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node.
|
||||
## Persistent name resolution rules
|
||||
|
||||
You can configure *persistent* name resolution rules. Name resolution for the specified items is done over the VPN.
|
||||
|
||||
Persistent name resolution is set using the `VPNv2/<ProfileName>/DomainNameInformationList/<dniRowId>/Persistent` node.
|
||||
|
||||
## Configure name resolution
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
:::image type="content" source="images/vpn-name-intune.png" alt-text="Creation of VPN profile in Intune: DNS options." lightbox="images/vpn-name-intune.png":::
|
||||
|
||||
The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table.
|
||||
|
||||
@ -62,7 +59,7 @@ The fields in **Add or edit DNS rule** in the Intune profile correspond to the X
|
||||
| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** |
|
||||
| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** |
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
---
|
||||
title: Optimizing Office 365 traffic for remote workers with the native Windows VPN client
|
||||
description: Learn how to optimize Office 365 traffic for remote workers with the native Windows VPN client
|
||||
title: Optimize Microsoft 365 traffic for remote workers with the Windows VPN client
|
||||
description: Learn how to optimize Microsoft 365 traffic for remote workers with the Windows VPN client
|
||||
ms.topic: article
|
||||
ms.date: 09/23/2021
|
||||
ms.date: 05/24/2023
|
||||
---
|
||||
# Optimizing Office 365 traffic for remote workers with the native Windows 10 and Windows 11 VPN client
|
||||
# Optimize Microsoft 365 traffic for remote workers with the Windows VPN client
|
||||
|
||||
This article describes how to configure the recommendations in the article [Optimize Office 365 connectivity for remote users using VPN split tunneling](/office365/enterprise/office-365-vpn-split-tunnel) for the *native Windows 10 and Windows 11 VPN client*. This guidance enables VPN administrators to optimize Office 365 usage while still ensuring that all other traffic goes over the VPN connection and through existing security gateways and tooling.
|
||||
This article describes how to configure the recommendations in the article [VPN split tunneling for Microsoft 365](/microsoft-365/enterprise/microsoft-365-vpn-split-tunnel) for the Windows VPN client. This guidance enables VPN administrators to optimize Microsoft 365 usage while ensuring that all other traffic goes over the VPN connection and through existing security gateways or tooling.
|
||||
|
||||
This can be achieved for the native/built-in Windows 10 and Windows 11 VPN client using a _Force Tunneling with Exclusions_ approach. This allows you to define IP-based exclusions *even when using force tunneling* in order to "split" certain traffic to use the physical interface while still forcing all other traffic via the VPN interface. Traffic addressed to specifically defined destinations (like those listed in the Office 365 optimize categories) will therefore follow a much more direct and efficient path, without the need to traverse or "hairpin" via the VPN tunnel and back out of the corporate network. For cloud-services like Office 365, this makes a huge difference in performance and usability for remote users.
|
||||
The recommendations can be implemented for the built-in Windows VPN client using a *Force Tunneling with Exclusions* approach, defining IP-based exclusions even when using *force tunneling*. Certain traffic can be *split* to use the physical interface, while still forcing all other traffic via the VPN interface. Traffic addressed to defined destinations (like those listed in the Microsoft 365 optimized categories) follows a much more direct and efficient path, without the need to traverse or *hairpin* via the VPN tunnel and back out of the organization's network. For cloud-services like Microsoft 365, this makes a significant difference in performance and usability for remote users.
|
||||
|
||||
> [!NOTE]
|
||||
> The term _force tunneling with exclusions_ is sometimes confusingly called "split tunnels" by other vendors and in some online documentation. For Windows 10 and Windows 11 VPN, the term _split tunneling_ is defined differently as described in the article [VPN routing decisions](./vpn-routing.md#split-tunnel-configuration).
|
||||
> The term *force tunneling with exclusions* is sometimes confusingly called *split tunnels* by other vendors and in some online documentation. For Windows VPN, the term *split tunneling* is defined differently, as described in the article [VPN routing decisions](./vpn-routing.md#split-tunnel-configuration).
|
||||
|
||||
## Solution Overview
|
||||
|
||||
@ -35,9 +35,9 @@ In order to define specific force tunnel exclusions, you then need to add the fo
|
||||
</Route>
|
||||
```
|
||||
|
||||
Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You will need to define a unique and separate `<Route></Route>` section for each required exclusion.
|
||||
Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You must define a unique and separate `<Route></Route>` section for each required exclusion.
|
||||
|
||||
An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is shown below:
|
||||
An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is the following:
|
||||
|
||||
```xml
|
||||
<VPNProfile>
|
||||
@ -62,11 +62,11 @@ An example of a correctly formatted Profile XML configuration for force tunnel w
|
||||
|
||||
## Solution Deployment
|
||||
|
||||
For Office 365, it is therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges) to ensure that they are excluded from VPN force tunneling.
|
||||
For Microsoft 365, it's therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](/microsoft-365/enterprise/urls-and-ip-address-ranges) to ensure that they're excluded from VPN force tunneling.
|
||||
|
||||
This can be achieved manually by adding the IP addresses defined within the *optimize* category entries to an existing Profile XML (or script) file, or alternatively the following script can be used which dynamically adds the required entries to an existing PowerShell script, or XML file, based upon directly querying the REST-based web service to ensure the correct IP address ranges are always used.
|
||||
|
||||
An example of a PowerShell script that can be used to update a force tunnel VPN connection with Office 365 exclusions is provided below.
|
||||
An example of a PowerShell script that can be used to update a force tunnel VPN connection with Microsoft 365 exclusions is provided below.
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
@ -79,9 +79,9 @@ An example of a PowerShell script that can be used to update a force tunnel VPN
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Applies or updates recommended Office 365 optimize IP address exclusions to an existing force tunnel Windows 10 and Windows 11 VPN profile
|
||||
Applies or updates recommended Microsoft 365 optimize IP address exclusions to an existing force tunnel Windows 10 and Windows 11 VPN profile
|
||||
.DESCRIPTION
|
||||
Connects to the Office 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges
|
||||
Connects to the Microsoft 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges
|
||||
Compares the optimized IP addresses with those contained in the supplied VPN Profile (PowerShell or XML file)
|
||||
Adds or updates IP addresses as necessary and saves the resultant file with "-NEW" appended to the file name
|
||||
.PARAMETERS
|
||||
@ -170,7 +170,7 @@ if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
}
|
||||
}
|
||||
|
||||
# Define Office 365 endpoints and service URLs #
|
||||
# Define Microsoft 365 endpoints and service URLs #
|
||||
$ws = "https://endpoints.office.com"
|
||||
$baseServiceUrl = "https://endpoints.office.com"
|
||||
|
||||
@ -198,7 +198,7 @@ if ($version[0].latest -gt $lastVersion)
|
||||
{
|
||||
|
||||
Write-Host
|
||||
Write-Host "A new version of Office 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan
|
||||
Write-Host "A new version of Microsoft 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan
|
||||
|
||||
# Write the new version number to the data file #
|
||||
@($clientRequestId, $version[0].latest) | Out-File $datapath
|
||||
@ -415,29 +415,13 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
}
|
||||
```
|
||||
|
||||
## Version Support
|
||||
|
||||
This solution is supported with the following versions of Windows:
|
||||
|
||||
- Windows 11
|
||||
- Windows 10 1903/1909 and newer: Included, no action needed
|
||||
- Windows 10 1809: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 1803: At least [KB4493437](https://support.microsoft.com/help/4493437/windows-10-update-kb4493437)
|
||||
- Windows 10 1709 and lower: Exclusion routes are not supported
|
||||
|
||||
- Windows 10 Enterprise 2019 LTSC: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 Enterprise 2016 LTSC: Exclusion routes are not supported
|
||||
- Windows 10 Enterprise 2015 LTSC: Exclusion routes are not supported
|
||||
|
||||
Microsoft strongly recommends that the latest available Windows 10 cumulative update always be applied.
|
||||
|
||||
## Other Considerations
|
||||
|
||||
You should also be able to adapt this approach to include necessary exclusions for other cloud-services that can be defined by known/static IP addresses; exclusions required for [Cisco WebEx](https://help.webex.com/WBX000028782/Network-Requirements-for-Webex-Teams-Services) or [Zoom](https://support.zoom.us/hc/en-us/articles/201362683) are good examples.
|
||||
|
||||
## Examples
|
||||
|
||||
An example of a PowerShell script that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script:
|
||||
An example of a PowerShell script that can be used to create a force tunnel VPN connection with Microsoft 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script:
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
@ -462,7 +446,7 @@ An example of a PowerShell script that can be used to create a force tunnel VPN
|
||||
#>
|
||||
|
||||
<#-- Define Key VPN Profile Parameters --#>
|
||||
$ProfileName = 'Contoso VPN with Office 365 Exclusions'
|
||||
$ProfileName = 'Contoso VPN with Microsoft 365 Exclusions'
|
||||
$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
|
||||
|
||||
<#-- Define VPN ProfileXML --#>
|
||||
@ -656,7 +640,7 @@ Write-Host "$Message"
|
||||
|
||||
```
|
||||
|
||||
An example of an [Intune-ready XML file](./vpn-profile-options.md#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file.
|
||||
An example of an [Intune-ready XML file](./vpn-profile-options.md#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Microsoft 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file.
|
||||
|
||||
>[!NOTE]
|
||||
>This XML is formatted for use with Intune and cannot contain any carriage returns or whitespace.
|
||||
|
||||
@ -1,53 +1,49 @@
|
||||
---
|
||||
ms.date: 09/23/2021
|
||||
ms.date: 05/24/2023
|
||||
title: VPN routing decisions
|
||||
description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
|
||||
ms.topic: conceptual
|
||||
---
|
||||
# VPN routing decisions
|
||||
|
||||
Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (*force tunnel*) or only some data through the VPN (*split tunnel*). This decision impacts the configuration and the capacity planning, as well as security expectations from the connection.
|
||||
Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (*force tunnel*) or only some data through the VPN (*split tunnel*). The decision impacts the configuration, capacity planning, and security expectations from the connection.
|
||||
|
||||
## Split tunnel configuration
|
||||
|
||||
In a split tunnel configuration, routes can be specified to go over VPN and all other traffic will go over the physical interface.
|
||||
In a split tunnel configuration, routes can be specified to go over VPN and all other traffic will go over the physical interface.
|
||||
|
||||
Routes can be configured using the VPNv2/*ProfileName*/RouteList setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
For each route item in the list, the following can be specified:
|
||||
Routes can be configured using the `VPNv2/<ProfileName>/RouteList` setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
- **Address**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Address
|
||||
- **Prefix size**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Prefix
|
||||
- **Exclusion route**: VPNv2/*ProfileName*/RouteList/*routeRowId*/ExclusionRoute
|
||||
|
||||
Windows VPN platform now supports the ability to specify exclusion routes that specifically should not go over the physical interface.
|
||||
For each route item in the list, you can configure the following options:
|
||||
|
||||
- **Address**: `VPNv2/<ProfileName>/RouteList/<routeRowId>/Address`
|
||||
- **Prefix size**: `VPNv2/<ProfileName>/RouteList/<routeRowId>/Prefix`
|
||||
- **Exclusion route**: V`VPNv2/<ProfileName>/RouteList/<routeRowId>/ExclusionRoute`
|
||||
|
||||
With Windows VPN, you can specify exclusion routes that shouldn't go over the physical interface.
|
||||
|
||||
Routes can also be added at connect time through the server for UWP VPN apps.
|
||||
|
||||
## Force tunnel configuration
|
||||
|
||||
In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified.
|
||||
In a force tunnel configuration, all traffic will go over VPN. Force tunnel is the default configuration, and takes effect when no routes are specified.
|
||||
|
||||
The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn't a specific route on the physical interface itself.
|
||||
The only implication of force tunnel is the manipulation of routing entries: VPN V4 and V6 default routes (for example *0.0.0.0/0*) are added to the routing table with a lower metric than ones for other interfaces. This configuration sends traffic through the VPN as long as there isn't a specific route on the physical interface:
|
||||
|
||||
For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**.
|
||||
|
||||
For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in indicates the default route for IPv4 and IPv6 as the only two Inclusion routes, the VPN platform marks the connection as Force Tunneled.
|
||||
- For built-in VPN, the decision is controlled using the MDM setting `VPNv2/ProfileName/NativeProfile/RoutingPolicyType`
|
||||
- For a UWP VPN plug-in, the app controls the property. If the VPN plug-in indicates the default route for IPv4 and IPv6 as the only two Inclusion routes, the VPN platform marks the connection as Force Tunneled
|
||||
|
||||
## Configure routing
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration.
|
||||
When you configure a VPN profile in Microsoft Intune, you can enable split tunnel configuration:
|
||||
|
||||
|
||||
|
||||
Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection.
|
||||
|
||||
|
||||
Once enabled, you can add the routes that should use the VPN connection.
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: VPN security features
|
||||
description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters.
|
||||
ms.date: 07/21/2022
|
||||
description: Learn about security features for VPN, including LockDown VPN and traffic filters.
|
||||
ms.date: 05/24/2023
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
@ -9,42 +9,27 @@ ms.topic: conceptual
|
||||
|
||||
## Hyper-V based containers and VPN
|
||||
|
||||
Windows supports different kinds of Hyper-V based containers. This support includes, but isn't limited to, Microsoft Defender Application Guard and Windows Sandbox. When you use 3rd party VPN solutions, these Hyper-V based containers may not be able to seamlessly connect to the internet. Additional configurational changes might be needed to resolve connectivity issues.
|
||||
|
||||
For example, for more information on a workaround for Cisco AnyConnect VPN, see [Cisco AnyConnect Secure Mobility Client Administrator Guide: Connectivity issues with VM-based subsystems](https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/troubleshoot-anyconnect.html#Cisco_Task_in_List_GUI.dita_3a9a8101-f034-4e9b-b24a-486ee47b5e9f).
|
||||
|
||||
## Windows Information Protection (WIP) integration with VPN
|
||||
|
||||
Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally.
|
||||
|
||||
The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 or Windows 11 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include:
|
||||
|
||||
- Core functionality: File encryption and file access blocking
|
||||
- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations
|
||||
- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN
|
||||
- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN
|
||||
|
||||
The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app.
|
||||
|
||||
Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect.
|
||||
|
||||
[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
Windows supports different kinds of Hyper-V based containers, like Microsoft Defender Application Guard and Windows Sandbox. When you use a third party VPN solution, the Hyper-V based containers may not be able to seamlessly connect to the internet, and configuration changes may be needed to resolve connectivity issues.
|
||||
|
||||
For example, read about the workaround for Cisco AnyConnect VPN: [Cisco AnyConnect Secure Mobility Client Administrator Guide: Connectivity issues with VM-based subsystems](https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/troubleshoot-anyconnect.html#Cisco_Task_in_List_GUI.dita_3a9a8101-f034-4e9b-b24a-486ee47b5e9f).
|
||||
|
||||
## Traffic Filters
|
||||
|
||||
Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules:
|
||||
Traffic Filters enables organizations to decide what traffic is allowed into the corporate network based on policy. IT admins can use Traffic Filters to apply interface-specific firewall rules to the VPN Interface.
|
||||
|
||||
- App-based rules. With app-based rules, a list of applications can be marked to allow only traffic originating from these apps to go over the VPN interface.
|
||||
- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified to allow only traffic matching these rules to go over the VPN interface.
|
||||
There are two types of Traffic Filter rules:
|
||||
|
||||
There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level.
|
||||
- **App-based rules** consist of a list of applications that can be marked to only allow traffic originating from the apps to the VPN interface
|
||||
- **Traffic-based rules** consist of 5-tuple policies (ports, addresses, protocol) that can be specified to only allow traffic matching the rules to go through the VPN interface
|
||||
|
||||
For example, an admin could define rules that specify:
|
||||
There can be sets of rules linked by *OR*. Within each set, there can be app-based rules and traffic-based rules.\
|
||||
All the properties within the set are linked by *AND*. The rules can be applied at a per-app level or a per-device level.
|
||||
|
||||
- The Contoso HR App must be allowed to go through the VPN and only access port 4545.
|
||||
- The Contoso finance apps are allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889.
|
||||
- All other apps on the device should be able to access only ports 80 or 443.
|
||||
For example, an IT admin could define rules that specify:
|
||||
|
||||
- An *HR App* is allowed to go through the VPN and only access port *4545*
|
||||
- The *Finance apps* are allowed to through the VPN and only access the Remote IP ranges of *10.10.0.40 - 10.10.0.201* on port *5889*
|
||||
- All other apps on the device can only access ports *80* or *443*
|
||||
|
||||
## Configure traffic filters
|
||||
|
||||
@ -52,27 +37,26 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien
|
||||
|
||||
The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
:::image type="content" source="images/vpn-traffic-rules.png" alt-text="VPN profile creation from Microsoft Intune admin center." lightbox="images/vpn-traffic-rules.png":::
|
||||
|
||||
## LockDown VPN
|
||||
|
||||
A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features:
|
||||
|
||||
- The system attempts to keep the VPN connected at all times.
|
||||
- The user cannot disconnect the VPN connection.
|
||||
- The user cannot delete or modify the VPN profile.
|
||||
- The VPN LockDown profile uses forced tunnel connection.
|
||||
- If the VPN connection is not available, outbound network traffic is blocked.
|
||||
- Only one VPN LockDown profile is allowed on a device.
|
||||
- The system attempts to always keep the VPN connected
|
||||
- The user can't disconnect the VPN connection
|
||||
- The user can't delete or modify the VPN profile
|
||||
- The VPN LockDown profile uses forced tunnel connection
|
||||
- If the VPN connection isn't available, outbound network traffic is blocked
|
||||
- Only one VPN LockDown profile is allowed on a device
|
||||
|
||||
> [!NOTE]
|
||||
> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type.
|
||||
|
||||
Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected.
|
||||
> [!CAUTION]
|
||||
> Be careful when deploying LockDown VPN, as the resultant connection won't be able to send or receive any network traffic without the VPN connection being established.
|
||||
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user