mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-17 19:33:37 +00:00
moved files
This commit is contained in:
Paolo Matarazzo
@ -0,0 +1,36 @@
|
||||
---
|
||||
title: How to configure Diffie Hellman protocol over IKEv2 VPN connections
|
||||
description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections.
|
||||
ms.date: 09/23/2021
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# How to configure Diffie Hellman protocol over IKEv2 VPN connections
|
||||
|
||||
In IKEv2 VPN connections, the default configuration for Diffie Hellman group is Group 2, which is not secure for IKE exchanges.
|
||||
|
||||
To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets.
|
||||
|
||||
## VPN server
|
||||
|
||||
For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-VpnServerConfiguration](/powershell/module/remoteaccess/set-vpnserverconfiguration?view=win10-ps&preserve-view=true) to configure the tunnel type. This makes all IKE exchanges on IKEv2 tunnel use the secure configuration.
|
||||
|
||||
```powershell
|
||||
Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy
|
||||
```
|
||||
|
||||
On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn't have `-TunnelType`, the configuration applies to all tunnel types on the server.
|
||||
|
||||
```powershell
|
||||
Set-VpnServerIPsecConfiguration -CustomPolicy
|
||||
```
|
||||
|
||||
## VPN client
|
||||
|
||||
For VPN client, you need to configure each VPN connection.
|
||||
For example, run [Set-VpnConnectionIPsecConfiguration (version 4.0)](/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps&preserve-view=true) and specify the name of the connection:
|
||||
|
||||
|
||||
```powershell
|
||||
Set-VpnConnectionIPsecConfiguration -ConnectionName <String>
|
||||
```
|
||||
@ -0,0 +1,94 @@
|
||||
---
|
||||
title: How to use Single Sign-On (SSO) over VPN and Wi-Fi connections
|
||||
description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections.
|
||||
ms.date: 12/28/2022
|
||||
ms.topic: how-to
|
||||
---
|
||||
|
||||
# How to use Single Sign-On (SSO) over VPN and Wi-Fi connections
|
||||
|
||||
This article explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The following scenarios are typically used:
|
||||
|
||||
- Connecting to a network using Wi-Fi or VPN
|
||||
- Use credentials for Wi-Fi or VPN authentication to also authenticate requests to access domain resources, without being prompted for domain credentials
|
||||
|
||||
For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication.
|
||||
|
||||
The credentials that are used for the connection authentication are placed in *Credential Manager* as the default credentials for the **logon session**. Credential Manager stores credentials that can be used for specific domain resources. These are based on the target name of the resource:
|
||||
|
||||
- For VPN, the VPN stack saves its credential as the **session default**
|
||||
- For WiFi, Extensible Authentication Protocol (EAP) provides support
|
||||
|
||||
The credentials are placed in Credential Manager as a *session credential*:
|
||||
|
||||
- A *session credential* implies that it is valid for the current user session
|
||||
- The credentials are cleaned up when the WiFi or VPN connection is disconnected
|
||||
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 21H2 and later, the *session credential* is not visible in Credential Manager.
|
||||
|
||||
For example, if someone using Microsoft Edge tries to access a domain resource, Microsoft Edge has the right Enterprise Authentication capability. This allows [WinInet](/windows/win32/wininet/wininet-reference) to release the credentials that it gets from Credential Manager to the SSP that is requesting it.
|
||||
For more information about the Enterprise Authentication capability, see [App capability declarations](/windows/uwp/packaging/app-capability-declarations).
|
||||
|
||||
The local security authority will look at the device application to determine if it has the right capability. This includes items such as a Universal Windows Platform (UWP) application.
|
||||
If the app isn't a UWP, it doesn't matter.
|
||||
But, if the application is a UWP app, it will evaluate at the device capability for Enterprise Authentication.
|
||||
If it does have that capability and if the resource that you're trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
This behavior helps prevent credentials from being misused by untrusted third parties.
|
||||
|
||||
## Intranet zone
|
||||
|
||||
For the Intranet zone, by default it only allows single-label names, such as *http://finance*.
|
||||
If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](/windows/client-management/mdm/registry-csp).
|
||||
|
||||
### Setting the ZoneMap
|
||||
|
||||
The ZoneMap is controlled using a registry that can be set through MDM.
|
||||
By default, single-label names such as *http://finance* are already in the intranet zone.
|
||||
For multi-label names, such as *http://finance.net*, the ZoneMap needs to be updated.
|
||||
|
||||
## MDM Policy
|
||||
|
||||
OMA URI example:
|
||||
|
||||
`./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/<domain name>` as an `Integer` value of `1` for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Microsoft Edge browser.
|
||||
|
||||
## Credential requirements
|
||||
|
||||
For VPN, the following types of credentials will be added to credential manager after authentication:
|
||||
|
||||
- Username and password
|
||||
- Certificate-based authentication:
|
||||
- TPM Key Storage Provider (KSP) Certificate
|
||||
- Software Key Storage Provider (KSP) Certificates
|
||||
- Smart Card Certificate
|
||||
- Windows Hello for Business Certificate
|
||||
|
||||
The username should also include a domain that can be reached over the connection (VPN or WiFi).
|
||||
|
||||
## User certificate templates
|
||||
|
||||
If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
|
||||
|
||||
| Template element | Configuration |
|
||||
|------------------|---------------|
|
||||
| SubjectName | The user's distinguished name (DN) where the domain components of the distinguished name reflect the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is relevant in multi-forest environments as it ensures a domain controller can be located. |
|
||||
| SubjectAlternativeName | The user's fully qualified UPN where a domain name component of the user's UPN matches the organizations internal domain's DNS namespace. </br>This requirement is relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br><ul><li>Client Authentication (for the VPN)</li><li>EAP Filtering OID (for Windows Hello for Business)</li><li>SmartCardLogon (for Azure AD-joined devices)</li></ul>If the domain controllers require smart card EKU either:<ul><li>SmartCardLogon</li><li>id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4) </li></ul>Otherwise:</br><ul><li>TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2)</li></ul> |
|
||||
|
||||
## NDES server configuration
|
||||
|
||||
The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used.
|
||||
For more information, see [Configure certificate infrastructure for SCEP](/mem/intune/protect/certificates-scep-configure).
|
||||
|
||||
## Active Directory requirements
|
||||
|
||||
You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well.
|
||||
|
||||
Domain controllers must have appropriate KDC certificates for the client to trust them as domain controllers. Because phones are not domain-joined, the root CA of the KDC's certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
|
||||
|
||||
Domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication.
|
||||
This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server.
|
||||
|
||||
For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382).
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 94 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 82 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
@ -0,0 +1,92 @@
|
||||
---
|
||||
title: VPN authentication options (Windows 10 and Windows 11)
|
||||
description: Learn about the EAP authentication methods that Windows supports in VPNs to provide secure authentication using username/password and certificate-based methods.
|
||||
ms.date: 09/23/2021
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN authentication options
|
||||
|
||||
In addition to older and less-secure password-based authentication methods (which should be avoided), the built-in VPN solution uses Extensible Authentication Protocol (EAP) to provide secure authentication using both user name and password, and certificate-based methods. You can only configure EAP-based authentication if you select a built-in VPN type (IKEv2, L2TP, PPTP or Automatic).
|
||||
|
||||
Windows supports a number of EAP authentication methods.
|
||||
|
||||
- EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2):
|
||||
- User name and password authentication
|
||||
- Winlogon credentials - can specify authentication with computer sign-in credentials
|
||||
|
||||
- EAP-Transport Layer Security (EAP-TLS):
|
||||
- Supports the following types of certificate authentication:
|
||||
- Certificate with keys in the software Key Storage Provider (KSP)
|
||||
- Certificate with keys in Trusted Platform Module (TPM) KSP
|
||||
- Smart card certificates
|
||||
- Windows Hello for Business certificate
|
||||
|
||||
- Certificate filtering:
|
||||
- Certificate filtering can be enabled to search for a particular certificate to use to authenticate with
|
||||
- Filtering can be Issuer-based or extended key usage (EKU)-based
|
||||
|
||||
- Server validation - with TLS, server validation can be toggled on or off:
|
||||
- Server name - specify the server to validate
|
||||
- Server certificate - trusted root certificate to validate the server
|
||||
- Notification - specify if the user should get a notification asking whether to trust the server or not
|
||||
|
||||
- [Protected Extensible Authentication Protocol (PEAP)](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754179(v=ws.11)):
|
||||
- Server validation - with PEAP, server validation can be toggled on or off:
|
||||
- Server name - specify the server to validate
|
||||
- Server certificate - trusted root certificate to validate the server
|
||||
- Notification - specify if the user should get a notification asking whether to trust the server or not
|
||||
|
||||
- Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication:
|
||||
- EAP-MSCHAPv2
|
||||
- EAP-TLS
|
||||
|
||||
- Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.
|
||||
|
||||
- [Cryptobinding](/openspecs/windows_protocols/ms-peap/757a16c7-0826-4ba9-bb71-8c3f1339e937): By deriving and exchanging values from the PEAP phase 1 key material (**Tunnel Key**) and from the PEAP phase 2 inner EAP method key material (**Inner Session Key**), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.
|
||||
|
||||
- Tunneled Transport Layer Security (TTLS)
|
||||
- Inner method
|
||||
- Non-EAP
|
||||
- Password Authentication Protocol (PAP)
|
||||
- CHAP
|
||||
- MSCHAP
|
||||
- MSCHAPv2
|
||||
- EAP
|
||||
- MSCHAPv2
|
||||
- TLS
|
||||
- Server validation: in TTLS, the server must be validated. The following can be configured:
|
||||
- Server name
|
||||
- Trusted root certificate for server certificate
|
||||
- Whether there should be a server validation notification
|
||||
|
||||
For a UWP VPN plug-in, the app vendor controls the authentication method to be used. The following credential types can be used:
|
||||
|
||||
- Smart card
|
||||
- Certificate
|
||||
- Windows Hello for Business
|
||||
- User name and password
|
||||
- One-time password
|
||||
- Custom credential type
|
||||
|
||||
## Configure authentication
|
||||
|
||||
See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EAP XML configuration.
|
||||
|
||||
>[!NOTE]
|
||||
>To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](/windows/client-management/mdm/eap-configuration) to create a smart card certificate. [Learn more about Windows Hello for Business.](../hello-for-business/hello-identity-verification.md)
|
||||
|
||||
The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP).
|
||||
|
||||
:::image type="content" source="images/vpn-eap-xml.png" alt-text="EAP XML configuration in Intune profile.":::
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,94 @@
|
||||
---
|
||||
title: VPN auto-triggered profile options (Windows 10 and Windows 11)
|
||||
description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource.
|
||||
ms.date: 09/23/2021
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN auto-triggered profile options
|
||||
|
||||
In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules:
|
||||
|
||||
- App trigger
|
||||
- Name-based trigger
|
||||
- Always On
|
||||
|
||||
> [!NOTE]
|
||||
> Auto-triggered VPN connections will not work if Folder Redirection for AppData is enabled. Either Folder Redirection for AppData must be disabled or the auto-triggered VPN profile must be deployed in system context, which changes the path to where the rasphone.pbk file is stored.
|
||||
|
||||
|
||||
## App trigger
|
||||
|
||||
VPN profiles in Windows 10 or Windows 11 can be configured to connect automatically on the launch of a specified set of applications. You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection. You can also configure per-app VPN and specify traffic rules for each app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
|
||||
The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name.
|
||||
|
||||
[Find a package family name (PFN) for per-app VPN configuration](/mem/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
|
||||
## Name-based trigger
|
||||
|
||||
You can configure a domain name-based rule so that a specific domain name triggers the VPN connection.
|
||||
|
||||
Name-based auto-trigger can be configured using the VPNv2/*ProfileName*/DomainNameInformationList/dniRowId/AutoTrigger setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
There are four types of name-based triggers:
|
||||
|
||||
- Short name: for example, if **HRweb** is configured as a trigger and the stack sees a DNS resolution request for **HRweb**, the VPN will be triggered.
|
||||
- Fully-qualified domain name (FQDN): for example, if **HRweb.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request for **HRweb.corp.contoso.com**, the VPN will be triggered.
|
||||
- Suffix: for example, if **.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request with a matching suffix (such as **HRweb.corp.contoso.com**), the VPN will be triggered. For any short name resolution, VPN will be triggered and the DNS server will be queried for the *ShortName*.**corp.contoso.com**.
|
||||
- All: if used, all DNS resolution should trigger VPN.
|
||||
|
||||
|
||||
## Always On
|
||||
|
||||
Always On is a feature in Windows 10 and Windows 11 which enables the active VPN profile to connect automatically on the following triggers:
|
||||
|
||||
- User sign-in
|
||||
- Network change
|
||||
- Device screen on
|
||||
|
||||
When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction.
|
||||
|
||||
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers.
|
||||
|
||||
## Preserving user Always On preference
|
||||
|
||||
Windows has a feature to preserve a user's AlwaysOn preference. In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**.
|
||||
|
||||
Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference.
|
||||
|
||||
**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config<br/>
|
||||
**Value:** AutoTriggerDisabledProfilesList<br/>
|
||||
**Type:** REG_MULTI_SZ
|
||||
|
||||
|
||||
## Trusted network detection
|
||||
|
||||
This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffixes. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered.
|
||||
|
||||
Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
|
||||
## Configure app-triggered VPN
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,109 @@
|
||||
---
|
||||
title: VPN and conditional access (Windows 10 and Windows 11)
|
||||
description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps.
|
||||
ms.date: 09/23/2021
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN and conditional access
|
||||
|
||||
The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application.
|
||||
|
||||
>[!NOTE]
|
||||
>Conditional Access is an Azure AD Premium feature.
|
||||
|
||||
Conditional Access Platform components used for Device Compliance include the following cloud-based services:
|
||||
|
||||
- [Conditional Access Framework](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn)
|
||||
|
||||
- [Azure AD Connect Health](/azure/active-directory/connect-health/active-directory-aadconnect-health)
|
||||
|
||||
- [Windows Health Attestation Service](../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md#device-health-attestation) (optional)
|
||||
|
||||
- Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA.
|
||||
See also [Always On VPN deployment for Windows Server and Windows 10](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy).
|
||||
|
||||
- Azure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used. When the client reconnects and determines that the certificate has expired, the client will again check with Azure AD for health validation before a new certificate is issued.
|
||||
|
||||
- [Microsoft Intune device compliance policies](/mem/intune/protect/device-compliance-get-started) - Cloud-based device compliance leverages Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things.
|
||||
|
||||
- Antivirus status
|
||||
- Auto-update status and update compliance
|
||||
- Password policy compliance
|
||||
- Encryption compliance
|
||||
- Device health attestation state (validated against attestation service after query)
|
||||
|
||||
The following client-side components are also required:
|
||||
- [HealthAttestation Configuration Service Provider (CSP)](/windows/client-management/mdm/healthattestation-csp)
|
||||
- [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) DeviceCompliance node settings
|
||||
- Trusted Platform Module (TPM)
|
||||
|
||||
## VPN device compliance
|
||||
|
||||
At this time, the Azure AD certificates issued to users do not contain a CRL Distribution Point (CDP) and are not suitable for Key Distribution Centers (KDCs) to issue Kerberos tokens. For users to gain access to on-premises resources such as files on a network share, client authentication certificates must be deployed to the Windows profiles of the users, and their VPNv2 profiles must contain the <SSO> section.
|
||||
|
||||
Server-side infrastructure requirements to support VPN device compliance include:
|
||||
|
||||
- The VPN server should be configured for certificate authentication.
|
||||
- The VPN server should trust the tenant-specific Azure AD CA.
|
||||
- For client access using Kerberos/NTLM, a domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO).
|
||||
|
||||
After the server side is set up, VPN admins can add the policy settings for conditional access to the VPN profile using the VPNv2 DeviceCompliance node.
|
||||
|
||||
Two client-side configuration service providers are leveraged for VPN device compliance.
|
||||
|
||||
- VPNv2 CSP DeviceCompliance settings:
|
||||
- **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client attempts to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
|
||||
- **Sso**: entries under SSO should be used to direct the VPN client to use a certificate other than the VPN authentication certificate when accessing resources that require Kerberos authentication.
|
||||
- **Sso/Enabled**: if this field is set to **true**, the VPN client looks for a separate certificate for Kerberos authentication.
|
||||
- **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication.
|
||||
- **Sso/Eku**: comma-separated list of extended key usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication.
|
||||
- HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include:
|
||||
- Collects TPM data used to verify health states
|
||||
- Forwards the data to the Health Attestation Service (HAS)
|
||||
- Provisions the Health Attestation Certificate received from the HAS
|
||||
- Upon request, forward the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
|
||||
|
||||
> [!NOTE]
|
||||
> It's required that certificates used for obtaining Kerberos tickets to be issued from an on-premises CA, and that SSO to be enabled in the user's VPN profile. This will enable the user to access on-premises resources.
|
||||
> In the case of AzureAD-only joined devices (not hybrid joined devices), if the user certificate issued by the on-premises CA has the user UPN from AzureAD in Subject and SAN (Subject Alternative Name), the VPN profile must be modified to ensure that the client does not cache the credentials used for VPN authentication. To do this, after deploying the VPN profile to the client, modify the *Rasphone.pbk* on the client by changing the entry **UseRasCredentials** from 1 (default) to 0 (zero).
|
||||
|
||||
## Client connection flow
|
||||
|
||||
The VPN client side connection flow works as follows:
|
||||
|
||||
|
||||
|
||||
When a VPNv2 Profile is configured with \<DeviceCompliance> \<Enabled>true<\/Enabled> the VPN client uses this connection flow:
|
||||
|
||||
1. The VPN client calls into Windows 10's or Windows 11's Azure AD Token Broker, identifying itself as a VPN client.
|
||||
1. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
|
||||
1. If compliant, Azure AD requests a short-lived certificate.
|
||||
1. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing.
|
||||
1. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server.
|
||||
|
||||
## Configure conditional access
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
## Learn more about Conditional Access and Azure AD Health
|
||||
|
||||
- [Azure Active Directory conditional access](/azure/active-directory/conditional-access/overview)
|
||||
- [Getting started with Azure Active Directory Conditional Access](/azure/active-directory/authentication/tutorial-enable-azure-mfa)
|
||||
- [Control the health of Windows 10-based devices](../../threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)
|
||||
- Control the health of Windows 11-based devices
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](/archive/blogs/tip_of_the_day/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4)
|
||||
|
||||
|
||||
## Related topics
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: VPN connection types (Windows 10 and Windows 11)
|
||||
description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured.
|
||||
ms.date: 08/23/2021
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN connection types
|
||||
|
||||
Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization's private network.
|
||||
|
||||
There are many options for VPN clients. In Windows 10 and Windows 11, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured.
|
||||
|
||||
|
||||
|
||||
## Built-in VPN client
|
||||
|
||||
- Tunneling protocols
|
||||
|
||||
- [Internet Key Exchange version 2 (IKEv2)](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687731(v=ws.10))
|
||||
|
||||
Configure the IPsec/IKE tunnel cryptographic properties using the **Cryptography Suite** setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
- [L2TP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687761(v=ws.10))
|
||||
|
||||
L2TP with pre-shared key (PSK) authentication can be configured using the **L2tpPsk** setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
- [PPTP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687676(v=ws.10))
|
||||
|
||||
- [SSTP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687819(v=ws.10))
|
||||
|
||||
SSTP is supported for Windows desktop editions only. SSTP cannot be configured using mobile device management (MDM), but it is one of the protocols attempted in the **Automatic** option.
|
||||
|
||||
> [!NOTE]
|
||||
> When a VPN plug-in is used, the adapter will be listed as an SSTP adapter, even though the VPN protocol used is the plug-in's protocol.
|
||||
|
||||
- Automatic
|
||||
|
||||
The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt from most secure to least secure.
|
||||
|
||||
Configure **Automatic** for the **NativeProtocolType** setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
|
||||
|
||||
## Universal Windows Platform VPN plug-in
|
||||
|
||||
The Universal Windows Platform (UWP) VPN plug-ins were introduced in Windows 10 and Windows 11, although there was originally separate version available for the Windows 8.1 PC platform. Using the UWP platform, third-party VPN providers can create app-containerized plug-ins using WinRT APIs, eliminating the complexity and problems often associated with writing to system-level drivers.
|
||||
|
||||
There are a number of Universal Windows Platform VPN applications, such as Pulse Secure, Cisco AnyConnect, F5 Access, Sonicwall Mobile Connect, and Check Point Capsule. If you want to use a UWP VPN plug-in, work with your vendor for any custom settings needed to configure your VPN solution.
|
||||
|
||||
## Configure connection type
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
In Intune, you can also include custom XML for third-party plug-in profiles:
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,35 @@
|
||||
---
|
||||
title: Windows VPN technical guide (Windows 10 and Windows 11)
|
||||
description: Learn about decisions to make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment.
|
||||
ms.date: 02/21/2022
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows VPN technical guide
|
||||
|
||||
This guide will walk you through the decisions you will make for Windows 10 or Windows 11 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10 and Windows 11.
|
||||
|
||||
To create a Windows 10 VPN device configuration profile see: [Windows 10 and Windows Holographic device settings to add VPN connections using Intune](/mem/intune/configuration/vpn-settings-windows-10).
|
||||
|
||||
> [!NOTE]
|
||||
> This guide does not explain server deployment.
|
||||
|
||||
[!INCLUDE [virtual-private-network-vpn](../../../../includes/licensing/virtual-private-network-vpn.md)]
|
||||
|
||||
## In this guide
|
||||
|
||||
| Article | Description |
|
||||
| --- | --- |
|
||||
| [VPN connection types](vpn-connection-type.md) | Select a VPN client and tunneling protocol |
|
||||
| [VPN routing decisions](vpn-routing.md) | Choose between split tunnel and force tunnel configuration |
|
||||
| [VPN authentication options](vpn-authentication.md) | Select a method for Extensible Authentication Protocol (EAP) authentication. |
|
||||
| [VPN and conditional access](vpn-conditional-access.md) | Use Azure Active Directory policy evaluation to set access policies for VPN connections. |
|
||||
| [VPN name resolution](vpn-name-resolution.md) | Decide how name resolution should work |
|
||||
| [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) | Set a VPN profile to connect automatically by app or by name, to be "always on", and to not trigger VPN on trusted networks |
|
||||
| [VPN security features](vpn-security-features.md) | Configure traffic filtering, connect a VPN profile to Windows Information Protection (WIP), and more |
|
||||
| [VPN profile options](vpn-profile-options.md) | Combine settings into single VPN profile using XML |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
- [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure)
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: VPN name resolution (Windows 10 and Windows 11)
|
||||
description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server.
|
||||
ms.date: 09/23/2021
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN name resolution
|
||||
|
||||
When the VPN client connects to the VPN server, the VPN client receives the client IP address. The client may also receive the IP address of the Domain Name System (DNS) server and the IP address of the Windows Internet Name Service (WINS) server.
|
||||
|
||||
The name resolution setting in the VPN profile configures how name resolution should work on the system when VPN is connected. The networking stack first looks at the Name Resolution Policy table (NRPT) for any matches and tries a resolution in the case of a match. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (in the case of a short name) and a DNS query is sent out on the preferred interface. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces.
|
||||
|
||||
## Name Resolution Policy table (NRPT)
|
||||
|
||||
The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache.
|
||||
|
||||
There are 3 types of name matches that can set up for NRPT:
|
||||
|
||||
- Fully qualified domain name (FQDN) that can be used for direct matching to a name
|
||||
|
||||
- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (in case of a short name)
|
||||
|
||||
- Any resolution should attempt to first resolve with the proxy server/DNS server with this entry
|
||||
|
||||
NRPT is set using the **VPNv2/*ProfileName*/DomainNameInformationList** node of the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). This node also configures Web proxy server or domain name servers.
|
||||
|
||||
[Learn more about NRPT](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee649207(v=ws.10))
|
||||
|
||||
|
||||
## DNS suffix
|
||||
|
||||
This setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established.
|
||||
|
||||
Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node.
|
||||
|
||||
|
||||
|
||||
[Learn more about primaryDNS suffix](/previous-versions/windows/it-pro/windows-2000-server/cc959611(v=technet.10))
|
||||
|
||||
## Persistent
|
||||
|
||||
You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN.
|
||||
|
||||
Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node.
|
||||
|
||||
|
||||
|
||||
## Configure name resolution
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table.
|
||||
|
||||
| Field | XML |
|
||||
| --- | --- |
|
||||
| **Name** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DomainName** |
|
||||
| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** |
|
||||
| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,666 @@
|
||||
---
|
||||
title: Optimizing Office 365 traffic for remote workers with the native Windows VPN client
|
||||
description: Learn how to optimize Office 365 traffic for remote workers with the native Windows VPN client
|
||||
ms.topic: article
|
||||
ms.date: 09/23/2021
|
||||
---
|
||||
# Optimizing Office 365 traffic for remote workers with the native Windows 10 and Windows 11 VPN client
|
||||
|
||||
This article describes how to configure the recommendations in the article [Optimize Office 365 connectivity for remote users using VPN split tunneling](/office365/enterprise/office-365-vpn-split-tunnel) for the *native Windows 10 and Windows 11 VPN client*. This guidance enables VPN administrators to optimize Office 365 usage while still ensuring that all other traffic goes over the VPN connection and through existing security gateways and tooling.
|
||||
|
||||
This can be achieved for the native/built-in Windows 10 and Windows 11 VPN client using a _Force Tunneling with Exclusions_ approach. This allows you to define IP-based exclusions *even when using force tunneling* in order to "split" certain traffic to use the physical interface while still forcing all other traffic via the VPN interface. Traffic addressed to specifically defined destinations (like those listed in the Office 365 optimize categories) will therefore follow a much more direct and efficient path, without the need to traverse or "hairpin" via the VPN tunnel and back out of the corporate network. For cloud-services like Office 365, this makes a huge difference in performance and usability for remote users.
|
||||
|
||||
> [!NOTE]
|
||||
> The term _force tunneling with exclusions_ is sometimes confusingly called "split tunnels" by other vendors and in some online documentation. For Windows 10 and Windows 11 VPN, the term _split tunneling_ is defined differently as described in the article [VPN routing decisions](./vpn-routing.md#split-tunnel-configuration).
|
||||
|
||||
## Solution Overview
|
||||
|
||||
The solution is based upon the use of a VPN Configuration Service Provider Reference profile ([VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)) and the embedded [ProfileXML](/windows/client-management/mdm/vpnv2-profile-xsd). These are used to configure the VPN profile on the device. Various provisioning approaches can be used to create and deploy the VPN profile as discussed in the article [Step 6. Configure Windows 10 client Always On VPN connections](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files).
|
||||
|
||||
Typically, these VPN profiles are distributed using a Mobile Device Management solution like Intune, as described in [VPN profile options](./vpn-profile-options.md#apply-profilexml-using-intune) and [Configure the VPN client by using Intune](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#configure-the-vpn-client-by-using-intune).
|
||||
|
||||
To enable the use of force tunneling in Windows 10 or Windows 11 VPN, the `<RoutingPolicyType>` setting is typically configured with a value of _ForceTunnel_ in your existing Profile XML (or script) by way of the following entry, under the `<NativeProfile></NativeProfile>` section:
|
||||
|
||||
```xml
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
```
|
||||
|
||||
In order to define specific force tunnel exclusions, you then need to add the following lines to your existing Profile XML (or script) for each required exclusion, and place them outside of the `<NativeProfile></NativeProfile>` section as follows:
|
||||
|
||||
```xml
|
||||
<Route>
|
||||
<Address>[IP addresses or subnet]</Address>
|
||||
<PrefixSize>[IP Prefix]</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
```
|
||||
|
||||
Entries defined by the `[IP Addresses or Subnet]` and `[IP Prefix]` references will consequently be added to the routing table as _more specific route entries_ that will use the Internet-connected interface as the default gateway, as opposed to using the VPN interface. You will need to define a unique and separate `<Route></Route>` section for each required exclusion.
|
||||
|
||||
An example of a correctly formatted Profile XML configuration for force tunnel with exclusions is shown below:
|
||||
|
||||
```xml
|
||||
<VPNProfile>
|
||||
<NativeProfile>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>203.0.113.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>198.51.100.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
</VPNProfile>
|
||||
```
|
||||
|
||||
> [!NOTE]
|
||||
> The IP addresses and prefix size values in this example are used purely as examples only and should not be used.
|
||||
|
||||
## Solution Deployment
|
||||
|
||||
For Office 365, it is therefore necessary to add exclusions for all IP addresses documented within the optimize categories described in [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges) to ensure that they are excluded from VPN force tunneling.
|
||||
|
||||
This can be achieved manually by adding the IP addresses defined within the *optimize* category entries to an existing Profile XML (or script) file, or alternatively the following script can be used which dynamically adds the required entries to an existing PowerShell script, or XML file, based upon directly querying the REST-based web service to ensure the correct IP address ranges are always used.
|
||||
|
||||
An example of a PowerShell script that can be used to update a force tunnel VPN connection with Office 365 exclusions is provided below.
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
#
|
||||
# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
|
||||
# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
|
||||
# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
|
||||
# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Applies or updates recommended Office 365 optimize IP address exclusions to an existing force tunnel Windows 10 and Windows 11 VPN profile
|
||||
.DESCRIPTION
|
||||
Connects to the Office 365 worldwide commercial service instance endpoints to obtain the latest published IP address ranges
|
||||
Compares the optimized IP addresses with those contained in the supplied VPN Profile (PowerShell or XML file)
|
||||
Adds or updates IP addresses as necessary and saves the resultant file with "-NEW" appended to the file name
|
||||
.PARAMETERS
|
||||
Filename and path for a supplied Windows 10 or Windows 11 VPN profile file in either PowerShell or XML format
|
||||
.NOTES
|
||||
Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
|
||||
.VERSION
|
||||
1.0
|
||||
#>
|
||||
|
||||
param (
|
||||
[string]$VPNprofilefile
|
||||
)
|
||||
|
||||
$usage=@"
|
||||
|
||||
This script uses the following parameters:
|
||||
|
||||
VPNprofilefile - The full path and name of the VPN profile PowerShell script or XML file
|
||||
|
||||
EXAMPLES
|
||||
|
||||
To check a VPN profile PowerShell script file:
|
||||
|
||||
Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF POWERSHELL SCRIPT FILE]
|
||||
|
||||
To check a VPN profile XML file:
|
||||
|
||||
Update-VPN-Profile-Office365-Exclusion-Routes.ps1 -VPNprofilefile [FULLPATH AND NAME OF XML FILE]
|
||||
|
||||
"@
|
||||
|
||||
# Check if filename has been provided #
|
||||
if ($VPNprofilefile -eq "")
|
||||
{
|
||||
Write-Host "`nWARNING: You must specify either a PowerShell script or XML filename!" -ForegroundColor Red
|
||||
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
|
||||
$FileExtension = [System.IO.Path]::GetExtension($VPNprofilefile)
|
||||
|
||||
# Check if XML file exists and is a valid XML file #
|
||||
if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
{
|
||||
if ( Test-Path $VPNprofilefile )
|
||||
{
|
||||
$xml = New-Object System.Xml.XmlDocument
|
||||
try
|
||||
{
|
||||
$xml.Load((Get-ChildItem -Path $VPNprofilefile).FullName)
|
||||
|
||||
}
|
||||
catch [System.Xml.XmlException]
|
||||
{
|
||||
Write-Verbose "$VPNprofilefile : $($_.toString())"
|
||||
Write-Host "`nWARNING: The VPN profile XML file is not a valid xml file or incorrectly formatted!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}else
|
||||
{
|
||||
Write-Host "`nWARNING: VPN profile XML file does not exist or cannot be found!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Check if VPN profile PowerShell script file exists and contains a VPNPROFILE XML section #
|
||||
if ( $VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
{
|
||||
if ( (Test-Path $VPNprofilefile) )
|
||||
{
|
||||
if (-Not $(Select-String -Path $VPNprofilefile -Pattern "<VPNPROFILE>") )
|
||||
{
|
||||
Write-Host "`nWARNING: PowerShell script file does not contain a valid VPN profile XML section or is incorrectly formatted!" -ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}else
|
||||
{
|
||||
Write-Host "`nWARNING: PowerShell script file does not exist or cannot be found!"-ForegroundColor Red
|
||||
$usage
|
||||
exit
|
||||
}
|
||||
}
|
||||
|
||||
# Define Office 365 endpoints and service URLs #
|
||||
$ws = "https://endpoints.office.com"
|
||||
$baseServiceUrl = "https://endpoints.office.com"
|
||||
|
||||
# Path where client ID and latest version number will be stored #
|
||||
$datapath = $Env:TEMP + "\endpoints_clientid_latestversion.txt"
|
||||
|
||||
# Fetch client ID and version if data file exists; otherwise create new file #
|
||||
if (Test-Path $datapath)
|
||||
{
|
||||
$content = Get-Content $datapath
|
||||
$clientRequestId = $content[0]
|
||||
$lastVersion = $content[1]
|
||||
|
||||
}else
|
||||
{
|
||||
$clientRequestId = [GUID]::NewGuid().Guid
|
||||
$lastVersion = "0000000000"
|
||||
@($clientRequestId, $lastVersion) | Out-File $datapath
|
||||
}
|
||||
|
||||
# Call version method to check the latest version, and pull new data if version number is different #
|
||||
$version = Invoke-RestMethod -Uri ($ws + "/version?clientRequestId=" + $clientRequestId)
|
||||
|
||||
if ($version[0].latest -gt $lastVersion)
|
||||
{
|
||||
|
||||
Write-Host
|
||||
Write-Host "A new version of Office 365 worldwide commercial service instance endpoints has been detected!" -ForegroundColor Cyan
|
||||
|
||||
# Write the new version number to the data file #
|
||||
@($clientRequestId, $version[0].latest) | Out-File $datapath
|
||||
}
|
||||
|
||||
# Invoke endpoints method to get the new data #
|
||||
$uri = "$baseServiceUrl" + "/endpoints/worldwide?clientRequestId=$clientRequestId"
|
||||
|
||||
# Invoke endpoints method to get the data for the VPN profile comparison #
|
||||
$endpointSets = Invoke-RestMethod -Uri ($uri)
|
||||
$Optimize = $endpointSets | Where-Object { $_.category -eq "Optimize" }
|
||||
$optimizeIpsv4 = $Optimize.ips | Where-Object { ($_).contains(".") } | Sort-Object -Unique
|
||||
|
||||
# Temporarily include additional IP address until Teams client update is released
|
||||
$optimizeIpsv4 += "13.107.60.1/32"
|
||||
|
||||
# Process PowerShell script file start #
|
||||
if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
{
|
||||
Write-host "`nStarting PowerShell script exclusion route check...`n" -ForegroundColor Cyan
|
||||
|
||||
# Clear Variables to allow re-run testing #
|
||||
|
||||
$ARRVPN=$null # Array to hold VPN addresses from VPN profile PowerShell file #
|
||||
$In_Opt_Only=$null # Variable to hold IP addresses that only appear in the optimize list #
|
||||
$In_VPN_Only=$null # Variable to hold IP addresses that only appear in the VPN profile PowerShell file #
|
||||
|
||||
# Extract the Profile XML from the ps1 file #
|
||||
|
||||
$regex = '(?sm).*^*.<VPNProfile>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with the optimize list #
|
||||
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
[xml]$VPNprofilexml="<VPNProfile>"+$xmlbody+"</VPNProfile>"
|
||||
|
||||
# Loop through each address found in VPNPROFILE XML section #
|
||||
foreach ($Route in $VPNprofilexml.VPNProfile.Route)
|
||||
{
|
||||
$VPNIP=$Route.Address+"/"+$Route.PrefixSize
|
||||
[array]$ARRVPN=$ARRVPN+$VPNIP
|
||||
}
|
||||
|
||||
# In optimize address list only #
|
||||
$In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
|
||||
|
||||
# In VPN list only #
|
||||
$In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
|
||||
[array]$Inpfile = get-content $VPNprofilefile
|
||||
|
||||
if ($In_Opt_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
|
||||
|
||||
[int32]$insline=0
|
||||
|
||||
for ($i=0; $i -lt $Inpfile.count; $i++)
|
||||
{
|
||||
if ($Inpfile[$i] -match "</NativeProfile>")
|
||||
{
|
||||
$insline += $i # Record the position of the line after the NativeProfile section ends #
|
||||
}
|
||||
}
|
||||
$OFS = "`r`n"
|
||||
foreach ($NewIP in $In_Opt_Only)
|
||||
{
|
||||
# Add the missing IP address(es) #
|
||||
$IPInfo=$NewIP.Split("/")
|
||||
$InpFile[$insline] += $OFS+" <Route>"
|
||||
$InpFile[$insline] += $OFS+" <Address>"+$IPInfo[0].Trim()+"</Address>"
|
||||
$InpFile[$insline] += $OFS+" <PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"
|
||||
$InpFile[$insline] += $OFS+" <ExclusionRoute>true</ExclusionRoute>"
|
||||
$InpFile[$insline] += $OFS+" </Route>"
|
||||
}
|
||||
# Update fileName and write new PowerShell file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.ps1"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$InpFile | Set-Content $OutFile
|
||||
Write-Host "Exclusion routes have been added to VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
|
||||
}else
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
|
||||
$OutFile=$VPNprofilefile
|
||||
}
|
||||
|
||||
if ( $In_VPN_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Unknown exclusion route IP addresses have been found in the VPN profile`n" -ForegroundColor Yellow
|
||||
|
||||
foreach ($OldIP in $In_VPN_Only)
|
||||
{
|
||||
[array]$Inpfile = get-content $Outfile
|
||||
$IPInfo=$OldIP.Split("/")
|
||||
Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
|
||||
$matchstr="<Address>"+$IPInfo[0].Trim()+"</Address>"
|
||||
$DelAns=Read-host
|
||||
if ($DelAns.ToUpper() -eq "Y")
|
||||
{
|
||||
[int32]$insline=0
|
||||
for ($i=0; $i -lt $Inpfile.count; $i++)
|
||||
{
|
||||
if ($Inpfile[$i] -match $matchstr)
|
||||
{
|
||||
$insline += $i # Record the position of the line for the string match #
|
||||
}
|
||||
}
|
||||
# Remove entries from XML #
|
||||
$InpFile[$insline-1]="REMOVETHISLINE"
|
||||
$InpFile[$insline]="REMOVETHISLINE"
|
||||
$InpFile[$insline+1]="REMOVETHISLINE"
|
||||
$InpFile[$insline+2]="REMOVETHISLINE"
|
||||
$InpFile[$insline+3]="REMOVETHISLINE"
|
||||
$InpFile=$InpFile | Where-Object {$_ -ne "REMOVETHISLINE"}
|
||||
|
||||
# Update filename and write new PowerShell file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$Inpfile | Set-content $OutFile
|
||||
Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate PowerShell script file; the original file has not been modified`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Process XML file start #
|
||||
if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
{
|
||||
Write-host "`nStarting XML file exclusion route check...`n" -ForegroundColor Cyan
|
||||
|
||||
# Clear variables to allow re-run testing #
|
||||
$ARRVPN=$null # Array to hold VPN addresses from the XML file #
|
||||
$In_Opt_Only=$null # Variable to hold IP Addresses that only appear in optimize list #
|
||||
$In_VPN_Only=$null # Variable to hold IP Addresses that only appear in the VPN profile XML file #
|
||||
|
||||
# Extract the Profile XML from the XML file #
|
||||
$regex = '(?sm).*^*.<VPNProfile>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with optimize list #
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
[xml]$VPNRulesxml="$xmlbody"
|
||||
|
||||
# Loop through each address found in VPNPROFILE file #
|
||||
foreach ($Route in $VPNRulesxml.VPNProfile.Route)
|
||||
{
|
||||
$VPNIP=$Route.Address+"/"+$Route.PrefixSize
|
||||
[array]$ARRVPN=$ARRVPN+$VPNIP
|
||||
}
|
||||
|
||||
# In optimize address list only #
|
||||
$In_Opt_Only= $optimizeIpsv4 | Where {$ARRVPN -NotContains $_}
|
||||
|
||||
# In VPN list only #
|
||||
$In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
|
||||
[System.Collections.ArrayList]$Inpfile = get-content $VPNprofilefile
|
||||
|
||||
if ($In_Opt_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are unknown, missing, or need to be updated in the VPN profile`n" -ForegroundColor Red
|
||||
|
||||
foreach ($NewIP in $In_Opt_Only)
|
||||
{
|
||||
# Add the missing IP address(es) #
|
||||
$IPInfo=$NewIP.Split("/")
|
||||
$routes += "<Route>`n"+"`t<Address>"+$IPInfo[0].Trim()+"</Address>`n"+"`t<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>`n"+"`t<ExclusionRoute>true</ExclusionRoute>`n"+"</Route>`n"
|
||||
}
|
||||
$inspoint = $Inpfile.IndexOf("</VPNProfile>")
|
||||
$Inpfile.Insert($inspoint,$routes)
|
||||
|
||||
# Update filename and write new XML file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$InpFile | Set-Content $OutFile
|
||||
Write-Host "Exclusion routes have been added to VPN profile and output to a separate XML file; the original file has not been modified`n`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "Exclusion route IP addresses are correct and up to date in the VPN profile`n" -ForegroundColor Green
|
||||
$OutFile=$VPNprofilefile
|
||||
}
|
||||
|
||||
if ( $In_VPN_Only.Count -gt 0 )
|
||||
{
|
||||
Write-Host "Unknown exclusion route IP addresses found in the VPN profile`n" -ForegroundColor Yellow
|
||||
|
||||
foreach ($OldIP in $In_VPN_Only)
|
||||
{
|
||||
[array]$Inpfile = get-content $OutFile
|
||||
$IPInfo=$OldIP.Split("/")
|
||||
Write-Host "Unknown exclusion route IP address"$IPInfo[0]"has been found in the VPN profile - Do you wish to remove it? (Y/N)`n" -ForegroundColor Yellow
|
||||
$matchstr="<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
|
||||
$DelAns=Read-host
|
||||
if ($DelAns.ToUpper() -eq "Y")
|
||||
{
|
||||
# Remove unknown IP address(es) #
|
||||
$inspoint = $Inpfile[0].IndexOf($matchstr)
|
||||
$Inpfile[0] = $Inpfile[0].Replace($matchstr,"")
|
||||
|
||||
# Update filename and write new XML file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
$OutFile=$(Split-Path $VPNprofilefile -Parent)+"\"+$NewFileName
|
||||
$Inpfile | Set-content $OutFile
|
||||
Write-Host "`nAddress"$IPInfo[0]"exclusion route has been removed from the VPN profile and output to a separate XML file; the original file has not been modified`n" -ForegroundColor Green
|
||||
|
||||
}else
|
||||
{
|
||||
Write-Host "`nExclusion route IP address has *NOT* been removed from the VPN profile`n" -ForegroundColor Green
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Version Support
|
||||
|
||||
This solution is supported with the following versions of Windows:
|
||||
|
||||
- Windows 11
|
||||
- Windows 10 1903/1909 and newer: Included, no action needed
|
||||
- Windows 10 1809: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 1803: At least [KB4493437](https://support.microsoft.com/help/4493437/windows-10-update-kb4493437)
|
||||
- Windows 10 1709 and lower: Exclusion routes are not supported
|
||||
|
||||
- Windows 10 Enterprise 2019 LTSC: At least [KB4490481](https://support.microsoft.com/help/4490481/windows-10-update-kb4490481)
|
||||
- Windows 10 Enterprise 2016 LTSC: Exclusion routes are not supported
|
||||
- Windows 10 Enterprise 2015 LTSC: Exclusion routes are not supported
|
||||
|
||||
Microsoft strongly recommends that the latest available Windows 10 cumulative update always be applied.
|
||||
|
||||
## Other Considerations
|
||||
|
||||
You should also be able to adapt this approach to include necessary exclusions for other cloud-services that can be defined by known/static IP addresses; exclusions required for [Cisco WebEx](https://help.webex.com/WBX000028782/Network-Requirements-for-Webex-Teams-Services) or [Zoom](https://support.zoom.us/hc/en-us/articles/201362683) are good examples.
|
||||
|
||||
## Examples
|
||||
|
||||
An example of a PowerShell script that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial PowerShell script:
|
||||
|
||||
```powershell
|
||||
# Copyright (c) Microsoft Corporation. All rights reserved.
|
||||
#
|
||||
# THIS SAMPLE CODE AND INFORMATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
|
||||
# WHETHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
|
||||
# WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# IF THIS CODE AND INFORMATION IS MODIFIED, THE ENTIRE RISK OF USE OR RESULTS IN
|
||||
# CONNECTION WITH THE USE OF THIS CODE AND INFORMATION REMAINS WITH THE USER.
|
||||
|
||||
<#
|
||||
.SYNOPSIS
|
||||
Configures an AlwaysOn IKEv2 VPN Connection using a basic script
|
||||
.DESCRIPTION
|
||||
Configures an AlwaysOn IKEv2 VPN Connection with proxy PAC information and force tunneling
|
||||
.PARAMETERS
|
||||
Parameters are defined in a ProfileXML object within the script itself
|
||||
.NOTES
|
||||
Requires at least Windows 10 Version 1803 with KB4493437, 1809 with KB4490481, or later
|
||||
.VERSION
|
||||
1.0
|
||||
#>
|
||||
|
||||
<#-- Define Key VPN Profile Parameters --#>
|
||||
$ProfileName = 'Contoso VPN with Office 365 Exclusions'
|
||||
$ProfileNameEscaped = $ProfileName -replace ' ', '%20'
|
||||
|
||||
<#-- Define VPN ProfileXML --#>
|
||||
$ProfileXML = '<VPNProfile>
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<AlwaysOn>true</AlwaysOn>
|
||||
<TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection>
|
||||
<NativeProfile>
|
||||
<Servers>edge1.contoso.com</Servers>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
<NativeProtocolType>IKEv2</NativeProtocolType>
|
||||
<Authentication>
|
||||
<MachineMethod>Certificate</MachineMethod>
|
||||
</Authentication>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>13.107.6.152</Address>
|
||||
<PrefixSize>31</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.18.10</Address>
|
||||
<PrefixSize>31</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.128.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>23.103.160.0</Address>
|
||||
<PrefixSize>20</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.96.0.0</Address>
|
||||
<PrefixSize>13</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.104.0.0</Address>
|
||||
<PrefixSize>15</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.96.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>131.253.33.215</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>132.245.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>150.171.32.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>191.234.140.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>204.79.197.215</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.136.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>40.108.128.0</Address>
|
||||
<PrefixSize>17</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.104.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>104.146.128.0</Address>
|
||||
<PrefixSize>17</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>150.171.40.0</Address>
|
||||
<PrefixSize>22</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.60.1</Address>
|
||||
<PrefixSize>32</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>13.107.64.0</Address>
|
||||
<PrefixSize>18</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.112.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>52.120.0.0</Address>
|
||||
<PrefixSize>14</PrefixSize>
|
||||
<ExclusionRoute>true</ExclusionRoute>
|
||||
</Route>
|
||||
<Proxy>
|
||||
<AutoConfigUrl>http://webproxy.corp.contoso.com/proxy.pac</AutoConfigUrl>
|
||||
</Proxy>
|
||||
</VPNProfile>'
|
||||
|
||||
<#-- Convert ProfileXML to Escaped Format --#>
|
||||
$ProfileXML = $ProfileXML -replace '<', '<'
|
||||
$ProfileXML = $ProfileXML -replace '>', '>'
|
||||
$ProfileXML = $ProfileXML -replace '"', '"'
|
||||
|
||||
<#-- Define WMI-to-CSP Bridge Properties --#>
|
||||
$nodeCSPURI = './Vendor/MSFT/VPNv2'
|
||||
$namespaceName = "root\cimv2\mdm\dmmap"
|
||||
$className = "MDM_VPNv2_01"
|
||||
|
||||
<#-- Define WMI Session --#>
|
||||
$session = New-CimSession
|
||||
|
||||
<#-- Detect and Delete Previous VPN Profile --#>
|
||||
try
|
||||
{
|
||||
$deleteInstances = $session.EnumerateInstances($namespaceName, $className, $options)
|
||||
foreach ($deleteInstance in $deleteInstances)
|
||||
{
|
||||
$InstanceId = $deleteInstance.InstanceID
|
||||
if ("$InstanceId" -eq "$ProfileNameEscaped")
|
||||
{
|
||||
$session.DeleteInstance($namespaceName, $deleteInstance, $options)
|
||||
$Message = "Removed $ProfileName profile $InstanceId"
|
||||
Write-Host "$Message"
|
||||
} else {
|
||||
$Message = "Ignoring existing VPN profile $InstanceId"
|
||||
Write-Host "$Message"
|
||||
}
|
||||
}
|
||||
}
|
||||
catch [Exception]
|
||||
{
|
||||
$Message = "Unable to remove existing outdated instance(s) of $ProfileName profile: $_"
|
||||
Write-Host "$Message"
|
||||
exit
|
||||
}
|
||||
|
||||
<#-- Create VPN Profile --#>
|
||||
try
|
||||
{
|
||||
$newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", "$nodeCSPURI", 'String', 'Key')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", "$ProfileNameEscaped", 'String', 'Key')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ProfileXML", "$ProfileXML", 'String', 'Property')
|
||||
$newInstance.CimInstanceProperties.Add($property)
|
||||
|
||||
$session.CreateInstance($namespaceName, $newInstance, $options)
|
||||
$Message = "Created $ProfileName profile."
|
||||
Write-Host "$Message"
|
||||
Write-Host "$ProfileName profile summary:"
|
||||
$session.EnumerateInstances($namespaceName, $className, $options)
|
||||
}
|
||||
catch [Exception]
|
||||
{
|
||||
$Message = "Unable to create $ProfileName profile: $_"
|
||||
Write-Host "$Message"
|
||||
exit
|
||||
}
|
||||
|
||||
$Message = "Script Complete"
|
||||
Write-Host "$Message"
|
||||
|
||||
```
|
||||
|
||||
An example of an [Intune-ready XML file](./vpn-profile-options.md#apply-profilexml-using-intune) that can be used to create a force tunnel VPN connection with Office 365 exclusions is provided below, or refer to the guidance in [Create the ProfileXML configuration files](/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/vpn-deploy-client-vpn-connections#create-the-profilexml-configuration-files) to create the initial XML file.
|
||||
|
||||
>[!NOTE]
|
||||
>This XML is formatted for use with Intune and cannot contain any carriage returns or whitespace.
|
||||
|
||||
```xml
|
||||
<VPNProfile><RememberCredentials>true</RememberCredentials><DnsSuffix>corp.contoso.com</DnsSuffix><AlwaysOn>true</AlwaysOn><TrustedNetworkDetection>corp.contoso.com</TrustedNetworkDetection><NativeProfile><Servers>edge1.contoso.com</Servers><RoutingPolicyType>ForceTunnel</RoutingPolicyType><NativeProtocolType>IKEv2</NativeProtocolType><Authentication><MachineMethod>Certificate</MachineMethod></Authentication></NativeProfile><Route><Address>13.107.6.152</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.18.10</Address><PrefixSize>31</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.128.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>23.103.160.0</Address><PrefixSize>20</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.96.0.0</Address><PrefixSize>13</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.104.0.0</Address><PrefixSize>15</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.96.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>131.253.33.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>132.245.0.0</Address><PrefixSize>16</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.32.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>191.234.140.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>204.79.197.215</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.136.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>40.108.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.104.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>104.146.128.0</Address><PrefixSize>17</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>150.171.40.0</Address><PrefixSize>22</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.60.1</Address><PrefixSize>32</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>13.107.64.0</Address><PrefixSize>18</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.112.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Route><Address>52.120.0.0</Address><PrefixSize>14</PrefixSize><ExclusionRoute>true</ExclusionRoute></Route><Proxy><AutoConfigUrl>http://webproxy.corp.contoso.com/proxy.pac</AutoConfigUrl></Proxy></VPNProfile>
|
||||
```
|
||||
@ -0,0 +1,329 @@
|
||||
---
|
||||
title: VPN profile options (Windows 10 and Windows 11)
|
||||
description: Windows adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network.
|
||||
ms.date: 05/17/2018
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN profile options
|
||||
|
||||
Most of the VPN settings in Windows 10 and Windows 11 can be configured in VPN profiles using Microsoft Intune or Microsoft Configuration Manager. All VPN settings in Windows 10 and Windows 11 can be configured using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
>[!NOTE]
|
||||
>If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) first.
|
||||
|
||||
The following table lists the VPN settings and whether the setting can be configured in Intune and Configuration Manager, or can only be configured using **ProfileXML**.
|
||||
|
||||
| Profile setting | Can be configured in Intune and Configuration Manager |
|
||||
| --- | --- |
|
||||
| Connection type | Yes |
|
||||
| Routing: split-tunnel routes | Yes, except exclusion routes |
|
||||
| Routing: forced-tunnel | Yes |
|
||||
| Authentication (EAP) | Yes, if connection type is built in |
|
||||
| Conditional access | Yes |
|
||||
| Name resolution: NRPT | Yes |
|
||||
| Name resolution: DNS suffix | No |
|
||||
| Name resolution: persistent | No |
|
||||
| Auto-trigger: app trigger | Yes |
|
||||
| Auto-trigger: name trigger | Yes |
|
||||
| Auto-trigger: Always On | Yes |
|
||||
| Auto-trigger: trusted network detection | No |
|
||||
| LockDown | No |
|
||||
| Windows Information Protection (WIP) | Yes |
|
||||
| Traffic filters | Yes |
|
||||
| Proxy settings | Yes, by PAC/WPAD file or server and port |
|
||||
|
||||
> [!NOTE]
|
||||
> VPN proxy settings are only used on Force Tunnel Connections. On Split Tunnel Connections, the general proxy settings are used.
|
||||
|
||||
The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This node is useful for deploying profiles with features that aren't yet supported by MDMs. You can get more examples in the [ProfileXML XSD](/windows/client-management/mdm/vpnv2-profile-xsd) article.
|
||||
|
||||
|
||||
## Sample Native VPN profile
|
||||
|
||||
The following sample is a sample Native VPN profile. This blob would fall under the ProfileXML node.
|
||||
|
||||
```xml
|
||||
<VPNProfile>
|
||||
<ProfileName>TestVpnProfile</ProfileName>
|
||||
<NativeProfile>
|
||||
<Servers>testServer.VPN.com</Servers>
|
||||
<NativeProtocolType>IKEv2</NativeProtocolType>
|
||||
|
||||
<!--Sample EAP profile (PEAP)-->
|
||||
<Authentication>
|
||||
<UserMethod>Eap</UserMethod>
|
||||
<Eap>
|
||||
<Configuration>
|
||||
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||
<EapMethod>
|
||||
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type>
|
||||
<VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
|
||||
<VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
|
||||
<AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
|
||||
</EapMethod>
|
||||
<Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
|
||||
<Type>25</Type>
|
||||
<EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1">
|
||||
<ServerValidation>
|
||||
<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
|
||||
<ServerNames></ServerNames>
|
||||
<TrustedRootCA>d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 </TrustedRootCA>
|
||||
<TrustedRootCA>d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 </TrustedRootCA>
|
||||
</ServerValidation>
|
||||
<FastReconnect>true</FastReconnect>
|
||||
<InnerEapOptional>false</InnerEapOptional>
|
||||
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
|
||||
<Type>13</Type>
|
||||
<EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
|
||||
<CredentialsSource>
|
||||
<CertificateStore>
|
||||
<SimpleCertSelection>true</SimpleCertSelection>
|
||||
</CertificateStore>
|
||||
</CredentialsSource>
|
||||
<ServerValidation>
|
||||
<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
|
||||
<ServerNames></ServerNames>
|
||||
<TrustedRootCA>d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 </TrustedRootCA>
|
||||
<TrustedRootCA>d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 </TrustedRootCA>
|
||||
</ServerValidation>
|
||||
<DifferentUsername>false</DifferentUsername>
|
||||
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation>
|
||||
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName>
|
||||
<TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
|
||||
<FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3">
|
||||
<EKUMapping>
|
||||
<EKUMap>
|
||||
<EKUName>AAD Conditional Access</EKUName>
|
||||
<EKUOID>1.3.6.1.4.1.311.87</EKUOID>
|
||||
</EKUMap>
|
||||
</EKUMapping>
|
||||
<ClientAuthEKUList Enabled="true">
|
||||
<EKUMapInList>
|
||||
<EKUName>AAD Conditional Access</EKUName>
|
||||
</EKUMapInList>
|
||||
</ClientAuthEKUList>
|
||||
</FilteringInfo>
|
||||
</TLSExtensions>
|
||||
</EapType>
|
||||
</Eap>
|
||||
<EnableQuarantineChecks>false</EnableQuarantineChecks>
|
||||
<RequireCryptoBinding>true</RequireCryptoBinding>
|
||||
<PeapExtensions>
|
||||
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation>
|
||||
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName>
|
||||
</PeapExtensions>
|
||||
</EapType>
|
||||
</Eap>
|
||||
</Config>
|
||||
</EapHostConfig>
|
||||
</Configuration>
|
||||
</Eap>
|
||||
</Authentication>
|
||||
|
||||
<!--Sample routing policy: in this case, this is a split tunnel configuration with two routes configured-->
|
||||
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
|
||||
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>192.168.0.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>10.10.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
</Route>
|
||||
|
||||
<!--VPN will be triggered for the two apps specified here-->
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>C:\windows\system32\ping.exe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
|
||||
<!--Example of per-app VPN. This configures traffic filtering rules for two apps. Internet Explorer is configured for force tunnel, meaning that all traffic allowed through this app must go over VPN. Microsoft Edge is configured as split tunnel, so whether data goes over VPN or the physical interface is dictated by the routing configuration.-->
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
<Protocol>6</Protocol>
|
||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||
</TrafficFilter>
|
||||
|
||||
<!--Name resolution configuration. The AutoTrigger node configures name-based triggering. In this profile, the domain "hrsite.corporate.contoso.com" triggers VPN.-->
|
||||
<DomainNameInformation>
|
||||
<DomainName>hrsite.corporate.contoso.com</DomainName>
|
||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||
<AutoTrigger>true</AutoTrigger>
|
||||
</DomainNameInformation>
|
||||
<DomainNameInformation>
|
||||
<DomainName>.corp.contoso.com</DomainName>
|
||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||
</DomainNameInformation>
|
||||
|
||||
<!--EDPMode is turned on for the enterprise ID "corp.contoso.com". When a user accesses an app with that ID, VPN will be triggered.-->
|
||||
<EdpModeId>corp.contoso.com</EdpModeId>
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
|
||||
<!--Always On is turned off, and triggering VPN for the apps and domain name specified earlier in the profile will not occur if the user is connected to the trusted network "contoso.com".-->
|
||||
<AlwaysOn>false</AlwaysOn>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<TrustedNetworkDetection>contoso.com</TrustedNetworkDetection>
|
||||
<Proxy>
|
||||
<Manual>
|
||||
<Server>HelloServer</Server>
|
||||
</Manual>
|
||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||
</Proxy>
|
||||
|
||||
<!--Device compliance is enabled and an alternate certificate is specified for domain resource authentication.-->
|
||||
<DeviceCompliance>
|
||||
<Enabled>true</Enabled>
|
||||
<Sso>
|
||||
<Enabled>true</Enabled>
|
||||
<Eku>This is my Eku</Eku>
|
||||
<IssuerHash>This is my issuer hash</IssuerHash>
|
||||
</Sso>
|
||||
</DeviceCompliance>
|
||||
</VPNProfile>
|
||||
```
|
||||
|
||||
## Sample plug-in VPN profile
|
||||
|
||||
The following sample is a sample plug-in VPN profile. This blob would fall under the ProfileXML node.
|
||||
|
||||
```xml
|
||||
<VPNProfile>
|
||||
<ProfileName>TestVpnProfile</ProfileName>
|
||||
<PluginProfile>
|
||||
<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
|
||||
<PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
|
||||
<CustomConfiguration><pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema></CustomConfiguration>
|
||||
</PluginProfile>
|
||||
<Route>
|
||||
<Address>192.168.0.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>10.10.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
</Route>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
<Protocol>6</Protocol>
|
||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||
<!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
|
||||
<!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
|
||||
</TrafficFilter>
|
||||
<DomainNameInformation>
|
||||
<DomainName>corp.contoso.com</DomainName>
|
||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||
<AutoTrigger>false</AutoTrigger>
|
||||
</DomainNameInformation>
|
||||
<DomainNameInformation>
|
||||
<DomainName>corp.contoso.com</DomainName>
|
||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||
</DomainNameInformation>
|
||||
<!--<EdpModeId>corp.contoso.com</EdpModeId>-->
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
<AlwaysOn>false</AlwaysOn>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
|
||||
<Proxy>
|
||||
<Manual>
|
||||
<Server>HelloServer</Server>
|
||||
</Manual>
|
||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||
</Proxy>
|
||||
</VPNProfile>
|
||||
```
|
||||
|
||||
## Apply ProfileXML using Intune
|
||||
|
||||
After you configure the settings that you want using ProfileXML, you can create a custom profile in the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). After it's created, you deploy this profile to your devices.
|
||||
|
||||
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
3. Enter the following properties:
|
||||
|
||||
- **Platform**: Select **Windows 10 and later**
|
||||
- **Profile**: Select **Templates** > **Custom**.
|
||||
|
||||
4. Select **Create**.
|
||||
5. In **Basics**, enter the following properties:
|
||||
|
||||
- **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later.
|
||||
- **Description**: Enter a description for the profile. This setting is optional, but recommended.
|
||||
|
||||
6. Select **Next**.
|
||||
7. In **Configuration settings**, enter the following properties:
|
||||
|
||||
- **OMA-URI**: Enter `./user/vendor/MSFT/VPNv2/Your_VPN profile name_/ProfileXML`.
|
||||
- **Data type**: Select `String (XML file)`.
|
||||
- **Value**: Browse to, and select your XML file.
|
||||
|
||||
For more information on these settings, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
8. Select **Next**, and continue configuring the policy. For the specific steps and recommendations, see [Create a profile with custom settings in Intune](/mem/intune/configuration/custom-settings-configure).
|
||||
|
||||
## Learn more
|
||||
|
||||
- [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure)
|
||||
- [VPNv2 configuration service provider (CSP) reference](/windows/client-management/mdm/vpnv2-csp)
|
||||
- [How to Create VPN Profiles in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/dn261200(v=technet.10))
|
||||
|
||||
## Related articles
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
@ -0,0 +1,59 @@
|
||||
---
|
||||
ms.date: 09/23/2021
|
||||
title: VPN routing decisions
|
||||
description: Learn about approaches that either send all data through a VPN or only selected data. The one you choose impacts capacity planning and security expectations.
|
||||
ms.topic: conceptual
|
||||
---
|
||||
# VPN routing decisions
|
||||
|
||||
Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (*force tunnel*) or only some data through the VPN (*split tunnel*). This decision impacts the configuration and the capacity planning, as well as security expectations from the connection.
|
||||
|
||||
## Split tunnel configuration
|
||||
|
||||
In a split tunnel configuration, routes can be specified to go over VPN and all other traffic will go over the physical interface.
|
||||
|
||||
Routes can be configured using the VPNv2/*ProfileName*/RouteList setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp).
|
||||
|
||||
For each route item in the list, the following can be specified:
|
||||
|
||||
- **Address**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Address
|
||||
- **Prefix size**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Prefix
|
||||
- **Exclusion route**: VPNv2/*ProfileName*/RouteList/*routeRowId*/ExclusionRoute
|
||||
|
||||
Windows VPN platform now supports the ability to specify exclusion routes that specifically should not go over the physical interface.
|
||||
|
||||
Routes can also be added at connect time through the server for UWP VPN apps.
|
||||
|
||||
## Force tunnel configuration
|
||||
|
||||
In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified.
|
||||
|
||||
The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn't a specific route on the physical interface itself.
|
||||
|
||||
For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**.
|
||||
|
||||
For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in indicates the default route for IPv4 and IPv6 as the only two Inclusion routes, the VPN platform marks the connection as Force Tunneled.
|
||||
|
||||
## Configure routing
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration.
|
||||
|
||||
|
||||
|
||||
Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,84 @@
|
||||
---
|
||||
title: VPN security features
|
||||
description: Learn about security features for VPN, including LockDown VPN, Windows Information Protection integration with VPN, and traffic filters.
|
||||
ms.date: 07/21/2022
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# VPN security features
|
||||
|
||||
## Hyper-V based containers and VPN
|
||||
|
||||
Windows supports different kinds of Hyper-V based containers. This support includes, but isn't limited to, Microsoft Defender Application Guard and Windows Sandbox. When you use 3rd party VPN solutions, these Hyper-V based containers may not be able to seamlessly connect to the internet. Additional configurational changes might be needed to resolve connectivity issues.
|
||||
|
||||
For example, for more information on a workaround for Cisco AnyConnect VPN, see [Cisco AnyConnect Secure Mobility Client Administrator Guide: Connectivity issues with VM-based subsystems](https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect410/administration/guide/b-anyconnect-admin-guide-4-10/troubleshoot-anyconnect.html#Cisco_Task_in_List_GUI.dita_3a9a8101-f034-4e9b-b24a-486ee47b5e9f).
|
||||
|
||||
## Windows Information Protection (WIP) integration with VPN
|
||||
|
||||
Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally.
|
||||
|
||||
The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp) allows a Windows 10 or Windows 11 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include:
|
||||
|
||||
- Core functionality: File encryption and file access blocking
|
||||
- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations
|
||||
- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN
|
||||
- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN
|
||||
|
||||
The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app.
|
||||
|
||||
Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect.
|
||||
|
||||
[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
|
||||
|
||||
## Traffic Filters
|
||||
|
||||
Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins can use Traffic Filters to effectively add interface specific firewall rules on the VPN Interface. There are two types of Traffic Filter rules:
|
||||
|
||||
- App-based rules. With app-based rules, a list of applications can be marked to allow only traffic originating from these apps to go over the VPN interface.
|
||||
- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified to allow only traffic matching these rules to go over the VPN interface.
|
||||
|
||||
There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level.
|
||||
|
||||
For example, an admin could define rules that specify:
|
||||
|
||||
- The Contoso HR App must be allowed to go through the VPN and only access port 4545.
|
||||
- The Contoso finance apps are allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889.
|
||||
- All other apps on the device should be able to access only ports 80 or 443.
|
||||
|
||||
## Configure traffic filters
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration.
|
||||
|
||||
The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
|
||||
## LockDown VPN
|
||||
|
||||
A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features:
|
||||
|
||||
- The system attempts to keep the VPN connected at all times.
|
||||
- The user cannot disconnect the VPN connection.
|
||||
- The user cannot delete or modify the VPN profile.
|
||||
- The VPN LockDown profile uses forced tunnel connection.
|
||||
- If the VPN connection is not available, outbound network traffic is blocked.
|
||||
- Only one VPN LockDown profile is allowed on a device.
|
||||
|
||||
> [!NOTE]
|
||||
> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type.
|
||||
|
||||
Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
Reference in New Issue
Block a user