Certificate-based Point to Site Azure VPN through Intune

As the business world becomes increasingly mobile, cloud services are becoming even more attractive. But what if, as is often the case, there are still dependencies on an enterprise network - on Azure, for example? The solution is obvious: a point-to-site VPN ensures communication for mobile workers. In this how-to post, I discuss how a certificate-based point-to-site VPN to an Azure VPN gateway can be automatically rolled out to mobile clients through Intune. I also discuss how certificates can be automatically issued and renewed by a Certificate Authority in combination with Intune.

Solution architecture and involved components

Various components are required for the successful and automated rollout of the point-to-site VPN configuration. The following diagram shows the solution architecture and which components are necessary for a successful configuration.

In this scheme, two mobile devices are present at a non-specific location (remote workers). Intune manages the issuance of certificates via Certificate Authority (CA) and distributes them to the clients, as well as the VPN configuration profile. Equipped with the certificates and the VPN configuration, the clients can communicate with the enterprise network on Azure via the point-to-site VPN.

Initial situation and prerequisites

You can use these instructions to build the environment yourself. As a starting point, it is assumed that the Azure network you want to access via P2S VPN is already configured. In my example, I chose a hub and spoke topology, according to best practice. How you can quickly and easily create such a topology yourself can be found in my post "ARM Template Deployment - Hub and Spoke with Bastion".

In addition, a CA is of central importance for issuing and verifying certificates via SCEP. Again, I assume that you already have one in your environment. If not, you have to create one.

Note: You can create a CA the classic way, or get it as an out-of-the-box solution (as a service / CAaaS). I chose a solution that stores the certificates in an Azure Key Vault, as shown in the diagram (CAaaS with Key Vault).

Azure VPN Gateway

If not available, first create a VPN gateway on Azure. Navigate on Azure to "Virtual network gateways" and click on "Create". Then select the radio button "VPN" for "Gateway type" and the existing hub network for "Virtual network". Check all settings if they meet your requirements and then click on "Review + create".

Creating the gateway will then take about 45 minutes, but you can already proceed to the next steps.

Azure AD Group

Create a security group in the Azure Active Directory (AAD). You can later add all devices to this group on which you want to have the VPN configured. If you already have a suitable group, you can skip the following steps and continue with the Intune Configuration Profiles.

1. In Azure Active Directory navigate to «Groups».
2. Click on "New Group"
3. Keep «Group type» on «Security»
4. Assign a suitable name.
5. Do not assign any members for the time being.
6. Click on "Create" to create the group.

You will use this group to assign Intune configuration profiles, which you will create below.

Intune Trusted Certificate Profile

This profile contains the public root certificate of your CA, which will be used to sign the client certificates later. Make sure you have this certificate before you continue.

1. Open Microsoft Intune and navigate to "Devices" >> "Configuration Profiles" (direct link).
2. Click on "Create profile".
3. Select "Windows 10 and later" as platform.
4. Select "Templates" for the profile type.
5. Search for "Trusted certificate" and select this template.

6. Enter a name for the profile, e.g. "graber.cloud Root Cert". Click "Next".
7. Upload the root certificate and select "Computer certificate store - Root" in the dropdown of "Destination store".

8. Assign the profile to the previously created AAD group. In my case the group "VPN-P2S-Devices". Click "Next".
9. You can leave the item "Applicability Rules" empty. Click "Next".
10. Check the information in the summary. If they are correct, click on "Create" to create the profile.

Now proceed with the client certificate.

Client Certificate - SCEP Certificate Profile

This profile ensures that the client can request a certificate from your CA and that it is issued. For the configuration you need the SCEP server URL of your CA. Have this ready to continue with the following configuration.

1. Create another profile.
2. Choose "Windows 10 and later" as Platform, search for the template "SCEP certificate" and select it. Confirm with "Create".

3. Choose a Name and press "Next"
4. Select "Device" as the "Certificate type".
5. As "Subject name format" insert a suitable value for the automatic naming during certificate creation. I use the device ID of the AAD object for this. "CN={{AAD_Device_ID}}".

Note: Other possible values according to Microsoft are...
{{DeviceId}} – Intune Device ID
{{Device_Serial}}
{{Device_IMEI}}
{{SerialNumber}}
{{IMEINumber}}
{{WiFiMacAddress}}
{{IMEI}}
{{DeviceName}}
{{FullyQualifiedDomainName}} (For Windows and domain-joined devices only)
{{MEID}}

6. As «Subject alternative name» I chose «IntuneDeviceId://{{DeviceID}}».
7. Select the desired validity period for the certificates issued. I leave this at 1 year.
8. Select the desired "Key storage provider (KSP)". For me, "Enroll to Trusted Platform Module (TPM) KSP if present, otherwise Software KSP" is most appropriate.
9. As "Root Certificate" you select the previously configured "Trusted certificate profile". If you do not have any other "Trusted certificates", you can only select this one anyway.
10. On«Extended key usage» make sure to add «Client Authentication».
11. Under the item "Renewal threshold (%)" you can now define from when a certificate renewal should be performed. I have kept the default value "20".
12. Now add your "SCEP Server URLs". For example "https://contoso.com/certsrv/mscep/mscep.dll".

13. Assign the just configured profile to the same group as you did with the "Trusted certificate profile". In my case this is the group "VPN-P2S-Devices".
14. You can leave the item "Applicability Rules" empty. Click "Next".
15. Check the information in the summary. If they are correct, click on "Create" to create the profile.

Now you have already created the two certificate profiles, both the trust for the root certificate and the issuance for the client certificates. The preparations for the VPN configuration are now complete.

Point to Site VPN Gateway Configuration

Before the VPN tunnel can be configured for the clients, you must first complete the VPN gateway configuration for the point-to-site connection. In the meantime, the gateway should have been successfully created.

1. Navigate to the created "Azure VPN Gateway".
2. Under «Settings» choose «Point-to-site configuration».
3. Define the desired "address pool" for your clients that will connect via VPN. Make sure that you do not configure any network conflicts.
4. At "Tunnel type" you choose the type you want. In my example I use "IKEv2".

Note: If you use a different tunnel type, this must also be taken into account in the Intune VPN profile configuration.

5. At «Authentication type» choose «Azure certificate».
6. Now you define a name and insert the "Public Key" of the root certificate.
7. Click on "Save" to save the configuration.
8. Now select "Download VPN client" and download the ZIP file.

9. Open the ZIP file and open «VpnSettings.xml» in folder «Generic».
10. Copy the "VpnServer" address. You will need this later.

Your Azure VPN gateway is now fully configured for the point-to-site VPN. Now you configure the opposite side, the clients, using Intune.

Intune VPN Profile

This profile is responsible for configuring the VPN tunnel on the Windows 10 device. In order to configure it, you must have completed the previous configurations.

1. Create another profile via "Create profile".
2. Choose "Windows 10 and later" as Platform, search for the template "VPN" and select it. Confirm with "Create".

3. Choose a Name and press "Next"
4. Under "Base VPN" you define the "Connection name", with which the VPN then appears on the clients.
5. For "VPN server address" add the address of the Azure VPN gateway you copied from the XML file in the "Point to Site VPN Gateway Configuration".
6. Under "Connection type" you now select "IKEv2" (must match the configuration of the Azure VPN gateway).
7. For «Authentication method» choose «Machine Certificates».
8. Now select the previously configured "SCEP certificate".
9. Now define whether you want a "Device Tunnel" or not. Since a Device Tunnel is only possible with Windows 10 Enterprise, I have set this option to "Disable" in my example.
10. If desired, you can now define your "IKE Security Association Parameters" & "Child Security Association Parameters" to adjust the security to your standards.

11. Under "Split Tunneling" I set the value "Enable" to get a split tunnel, and define the routes I want...

Note: There are countless other settings that you can make in the VPN profile. However, depending on your environment, these are not absolutely necessary for a functioning setup and are therefore not considered further in this guide.

12. Assign the just configured profile to the same group as you did with the two certificate profiles. In my case this is the group "VPN-P2S-Devices".
13. You can leave the item "Applicability Rules" empty. Click "Next".
14. Check the information in the summary. If they are correct, click on "Create" to create the profile.

Finalization and device control

Now you have created all the profiles you need. Since these profiles are all assigned to the same Azure AD group, you can now easily manage the certificate and VPN configuration via this group. So now just add all the devices to the group on which you want to configure the certificate based point to site VPN through Intune.

On the client you will then find the root certificate in the computer certificates under "Trusted Root Certification Authorities" and the client certificate under "Personal".

If this is the case and you have configured the VPN correctly, you should now see that the VPN is connected.

You have successfully rolled out a certificate-based Point to Site Azure VPN via Intune without touching the Windows 10 devices.

Sources:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)?WT.mc_id=AZ-MVP-5004129

https://docs.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure?WT.mc_id=AZ-MVP-5004129