PowerShell:Azure Point to Site Connectivity Step By Step

Point to site connectivity is the recommended way while connecting to Azure Virtual network from a remote location for example while travelling or working from home office.Point-2Site

Point-to-Site native Azure certificate authentication connections use the following.

  • A RouteBased VPN gateway.
  • The public key (.cer file) for a root certificate, which is uploaded to Azure. Once the certificate is uploaded, it is considered a trusted certificate and is used for authentication.
  • A client certificate that is generated from the root certificate. The client certificate installed on each client computer that will connect to the VNet. This certificate is used for client authentication.
  • A VPN client configured to connect to Azure VNet.

Point-to-site VPN supports two authentication mechanisms:

  • Certificate-based authentication. In this authentication is the use of a Digital Certificate to identify a user, machine, or device before granting access to a resource, network, application, etc.In the case of user authentication, it is often deployed in coordination with traditional methods such as username and password. 

Public-key cryptography, or asymmetric cryptography, is an encryption scheme that uses two mathematically related, but not identical, keys – a public key and a private key. Unlike symmetric key algorithms that rely on one key to both encrypt and decrypt, each key performs a unique function. The public key is used to encrypt and the private key is used to decrypt.We can either use an internal or public certification authority (CA) or generate self-signed certificates. There are two steps involved here: 

  1. Upload the public key of the root (representing your public key infrastructure [PKI] deployment or a self-signed one) to Azure. Since we are protecting the VPN Gateway we need to associate it with the target virtual network containing the VPN gateway.
  2. Generate client certificates (typically one per user), either by relying on the same CA that you requested the root certificate from or by generating self-signed client certificates that reference the self-signed root certificate. Install the client certificates with their respective private keys in the private certificate store on client computers. Effectively, the VPN tunnel relies on the implicit trust between the client certificates on VPN client computers and the root certificate uploaded to the Azure VPN gateway.
  • RADIUS-based authentication to Active Directory or another RADIUS-capable identity provider. In this configuration, Azure VPN gateway relays authentication requests and responses between the RADIUS server and VPN clients.

Planning for Point to Site Authentication:

  1. IP Addressing: When you create a virtual network in the Azure portal and select the option to enable point-to-site connectivity, you will be required to configure address space for IP addresses that you want to assign to cross-premises clients connecting through a point-to-site connection. This address space must be from the private range 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. You must ensure that the range you select here does not overlap with other virtual networks or networks on your local site.                                                    Also, you will have to configure virtual network address space that the virtual network you are creating will use. This network address space also should not overlap with address space that you use in your on-premises environment.
  2. Gateway subnet:Each point-to-site VPN requires that you configure a dynamic routing gateway. A point-to-site VPN requires a gateway subnet which can host . Only the virtual network gateway uses the gateway subnet. 
  3. Certificate: Each P2S connectivity implementation requires two certificates
    • Root Certificate:You must first create a root certificate and upload it to the Azure management portal.
    • Client Certificate:Create client certificates used for authentication.This certificate will be deployed to client machines to connect to Azure network

Here are the steps involved to achieve the working solution by using PowerShell:

1. Start Azure PowerShell and sign in to your subscription.

Connect-AzAccount

2. If there are multiple subscriptions associated with your account, select the target subscription in which you are going to create a virtual network, and configure a point-to-site VPN.(in the example below I have used Visual Studio Subscription but you can use your own )

Get-AzSubscription
Select-AzSubscription -SubscriptionName "Visual Studio Enterprise"

3. Set variables to be used in the PowerShell script so we can use them in the following example. This way you can change the config in one place and run it


#Virtual network name
$VNetName  = "P2SVNet1"

#Front-End Subnet Name
$FESubName = "FrontEndSubnet"

#Backend Subnet Name
$BESubName = "BackendSubnet"

#Gateway Subnet Name
$GWSubName = "GatewaySubnet"

#First Virtual network prefix name
$VNetPrefix1 = "192.168.0.0/16"

#Second Virtual network prefix name
$VNetPrefix2 = "10.254.0.0/16"

#Front-End Subnet Prefix
$FESubPrefix = "192.168.1.0/24"

#Back-End Subnet Prefix
$BESubPrefix = "10.254.1.0/24"

#Gateway Subnet Prefix
$GWSubPrefix = "192.168.200.0/26"

#The machines which connects to the Azure network wil use this address from this pool
$VPNClientAddressPool = "172.16.201.0/24"

#Resource Group
$RG = "TestRG"

#Location of Resource group
$Location = "East US"

#Gateway name
$GWName = "VNet1Gateway"

#Gateway IP Address
$GWIPName = "VNet1GatewayIP"

#Gateway IPconfig name
$GWIPconfName = "GatewayIPConfig"

4. Create a new resource group

New-AzResourceGroup -Name $RG -Location $Location

5.Create Virtual network config for: a) Frontend subnet b) Backend subnet and c) Gateway subnet.

$fesub = New-AzVirtualNetworkSubnetConfig -Name $FESubName -AddressPrefix $FESubPrefix
$besub = New-AzVirtualNetworkSubnetConfig -Name $BESubName -AddressPrefix $BESubPrefix
$gwsub = New-AzVirtualNetworkSubnetConfig -Name $GWSubName -AddressPrefix $GWSubPrefix

6.Create a virtual network and specify a DNS server (optional) and save the config in the variable to use it later.

New-AzVirtualNetwork -Name $VNetName -ResourceGroupName $RG -Location $Location -AddressPrefix $VNetPrefix1,$VNetPrefix2 -Subnet $fesub, $besub, $gwsub -DnsServer 10.2.1.3

$vnet = Get-AzVirtualNetwork -Name $VNetName -ResourceGroupName $RG
$subnet = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet

When you go to Azure Portal and see it shows the Address space below:

Portal also shows the subnets created above

7. Create a public IP address and save it in the variable

$pip = New-AzPublicIpAddress -Name $GWIPName -ResourceGroupName $RG -Location $Location -AllocationMethod Dynamic

$ipconf = New-AzVirtualNetworkGatewayIpConfig -Name $GWIPconfName -Subnet $subnet -PublicIpAddress $pip

After executing the above command Azure Portal also shows the Public IP address as below:

8. Create a Virtual network Gateway and save them into variable for later use. Add the client address pool so when VPN clients will connect they will use the IP address of the pool.

 New-AzVirtualNetworkGateway -Name $GWName -ResourceGroupName $RG `
-Location $Location -IpConfigurations $ipconf -GatewayType Vpn `
-VpnType RouteBased -EnableBgp $false -GatewaySku VpnGw1 -VpnClientProtocol "IKEv2"


$Gateway = Get-AzVirtualNetworkGateway -ResourceGroupName $RG -Name $GWName
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $Gateway -VpnClientAddressPool $VPNClientAddressPool

You can validate in the Azure Portal that Virtual network gateway is created successfuly as below:

9.Generate Root Certificate. if you want to generate self signed certificate you can use the below mentioned commandlet.This commandlet also stores the certificate in the private certificate store. Then save the certificate name in the variable.

#self signed cert
$cert = New-SelfSignedCertificate -Type Custom -KeySpec Signature `
-Subject "CN=P2SRootCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" -KeyUsageProperty Sign -KeyUsage CertSign

#Store the certificate name in the variable
$P2SRootCertName = "rootcertificate.cer"

10.Generate client certificate.We have generated the self signed client certificate.

#client cert
New-SelfSignedCertificate -Type Custom -DnsName P2SChildCert -KeySpec Signature `
-Subject "CN=P2SChildCert" -KeyExportPolicy Exportable `
-HashAlgorithm sha256 -KeyLength 2048 `
-CertStoreLocation "Cert:\CurrentUser\My" `
-Signer $cert -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")

11.In case you need to install the same certificate on another machine use the below mentioned command-let.

#Step1: Export the client certificate:


$mypwd = ConvertTo-SecureString -String "1234" -Force -AsPlainText
#Please note the thubprint of the certificate5F98EBBFE735CDDAE00E33E0FD69050EF9220254 and this will be specific to the certificate. In case you do not know it use the commandlet 
Get-ChildItem -Path “Cert:\CurrentUser\My”

Export-PfxCertificate -Cert cert:\currentuser\my\5F98EBBFE735CDDAE00E33E0FD69050EF9220254 -FilePath c:\myexport.pfx -ChainOption EndEntityCertOnly -NoProperties -Password $mypwd

#Step2: Export the client certificate:

#Now import it nito another machine in this example I have used the path c:\mypfx but you can use any other patch

Get-ChildItem -Path c:\mypfx\my.pfx | Import-PfxCertificate -CertStoreLocation Cert:\CurrentUser\My -Exportable

12.Upload the root certificate public key to the Azure Virtual Network Gateway.

$filePathForCert = "C:\rootcertificate.cer"
$cert = new-object System.Security.Cryptography.X509Certificates.X509Certificate2($filePathForCert)
$CertBase64 = [system.convert]::ToBase64String($cert.RawData)
$p2srootcert = New-AzVpnClientRootCertificate -Name $P2SRootCertName -PublicCertData $CertBase64

Add-AzVpnClientRootCertificate -VpnClientRootCertificateName $P2SRootCertName -VirtualNetworkGatewayname "VNet1Gateway" -ResourceGroupName "TestRG" -PublicCertData $CertBase64

After exporting the certificate it will look like this

11.Configure VPN Client by downloaing VPN client from the Virtual network gateway.

11.1 Download the VPN Client

11.2 Unzip the downloaded folder and it will look like this

11.3 If you are using winfows then use the Windows folders depending upon the 86 bit or 64 bit version of the windows otherwise use generic folder for non-windows OS.IN case of Windows 10 we wil have to use WindowsAmd64 and it will look like this.

12.Once the VPN client is installed by running the setup it will look like this.If you go to VPN screen like this.

Once you click the client connection it will look like this:

13. Click connect button and VPN dialog box will appear.

Once you click the connect button this dialog box will disappear and it will show you the connected button like this.

14. Test and Verify if we are connected to the Azure network by going to command prompt and type ipconfig/all. This wil show that you are connected to the Vnet.That means you have successfully connected to the Azure VNet.

I hope this post was helpful!!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.