Point to Site (P2S) VPN Connection & Gateway Transit [Azure]
Published: 2022-07-11 06:48:00

## Introduction to Point to Site VPN Azure:


- A Point-to-Site (P2S) VPN connection helps to create a secure connection tunnel to your virtual network (VNet) from an individual client computer device.
- P2S VPN is established by initiating it from the client’s computer device. This solution is useful for WFH (Work From Home) employees who want to connect to Azure VNets from a remote location. 
- P2S VPN is also a useful solution to use in place of S2S VPN when you have only a few clients that want to connect to a VNet.
**

## Layout Diagram

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8e1o4kz8d0qynrptew1h.png)

## LAB WORK

**Ist of all create your Resource in the Resource Group**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jzu4fm35o5l9ttzwdb7.png)

```
RG-name-Resource.
Central-us
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wrao3yq3w0fsbg8xzecv.png)

**After That Create Two Virtual network naming Vnet-1 and Vnet-2 inside your Resource.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ufcl3u89k6jtkarbv0mc.png)

```
Inside Vnet-1[10.0.0.0/16] create a subnet[10.0.1.0/24] 

```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b1wq6nfpdezf77rw3m48.png)

```
Inside Vnet-2[11.0.0.0/16] create a subnet[11.0.1.0/24]

```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4dsipj36i8vdij8q3z3l.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2a1sk73geta8bjvjvyln.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fe69eh0m4i3anwh07umq.png)

**Now we Have Two Virtual Networks**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vyq2lyrw3fowiuqt07wv.png)

**Inside VNet-1 , Create a virtual machin**e 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ib7rv8bue43i9ru1wsiu.png)

```
Name= VM-Vnet-1
Central-us
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q8yevpoq8q59lxi8pdh1.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4322xtr2ienpp2dinwmm.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/om253ruzmy5rs2yxz7kb.png)

```
Public ip =none.
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9bp3ovr0hx6lgd0zbdvd.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cxwdwkivxpvleo7ler09.png)

**Similary Inside VNet-2 , Create a virtual machine**

```
Name= VM-Vnet-2
Central-us 
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5xdtxdcz3egaf0cadydi.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0jduntbw0ucjsubi0ilv.png)

```
Public ip =none.

```
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vbhmr6t6u38p6es1otxe.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m4rwpy8nok2an5mle6kz.png)

**Now Create a Gateway subnet inside your Virtual network Vnet-1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3hcyi6cu38sl5au5e2rz.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9rxdxiqeuqoi0jfy2qzz.png)

**Search For Virtual Network Gateway And create it
Go to Virtual Network Gateway service from Azure portal and click on create to fill the data
**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0mts4okbx256h96dae7n.png)

_Virtual-network-gateway as gateway name, now select the region of your Virtual Network, after that Virtual Network will automatically appear into the Virtual Network Section, SKU as VpnGw1 (includes max 250 connections with 640 Mbps throughput) and keep other options as the default shown in below Screenshot.
_

```
Name- Virtual-network-gateway
central-us
SKU-VPNGW1
Virtualnet-Vnet-1
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p6g6lb0h4ztqsnpcgfke.png)

**Provide the gateway subnet range or else it will automatically create based on CIDR,**

```
public-ip-adress-name-Virtual-network-gateway-ip
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ggzw4v8y5vnk6uvesfki.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/og2p80cux3oew9de8ux7.png)
** Its will take 25-30 minutes to deploy.**

## Create and Export Certificates 
**Generate a Root Certificate**
_Now open PowerShell and Run as administrator from your local machine to create root and client certificates. Execute the below script in PowerShell to create a root certificate. Once created will be installed in the user certificate app_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2hbcgxmdmqnlzw26pqo9.png)

```
Create a self signed Root Certificate
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5lembbgwrqqx2xrhcduj.png)

**Now we need to create a client certificate. Execute the below script in PowerShell. The below script will create a ChildCert certificate and install it in the user certificate app.
Create a Self signed Child certificate**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/as8pjve7vy9pay059oro.png)

**Copy this command and paste it in powershell.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qseulafw1s0oyjqiogfh.png)

**After that Go to Manage user certificate**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xyyuocbmqr39kfodee1c.png)

```
Click on personal -->  certificate -->P2SRootCert --> Export

[Right-click on root cert inside certmgr console. Click on Export]
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nx0y5mqagscwbio9wx64.png)

```
Select Base-64 encoded X.509(.cer)
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r1ghfuuj189wd3s81xxm.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wxawcmw6r3uetnby4qsg.png)

```
Now go to P2SChildCert --> Export[Right-click on root cert inside certmgr console. Click on Export] --> Yes,export the private key --> password - (any password)
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2ovij2hrdcolbqp62fbw.png)

**now it will imported to your folder**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8902vjawu296b75u1vmg.png)

**Configure Point to site Connection
Now open the newly created Virtual network Gateway. To define the Address pool from that end users will get IP. Click on the newly created VPN gateway connection.
-> From the left side Scroll bar click on Point-to-site configuration**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xssb3672rzepkj91mqqx.png)

**-> After that, click on Configure Now**

_Now provide IP address range for VPN address pool. I will be using 172.25.100/24. In Tunnel Type use SSTP(SSL). IKEv2 VPN can be used to connect from Mac devices. SSTP is only supported on Windows devices. Under Authentication type Select Azure Certificates._

_-> No under Root certificates. Under root certificate name type the certificate name and under public certificate data, paste the root certificate content. Open root certificate with notepad.  Do not copy —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– text from the file.
After filling in the information click on Save_

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kz5dot7agvp9k1d70kyz.png)
**
click on Download VPN client**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0qgjzjbjqt1nnuemc204.png)

**Then extract the downloaded file. Check the version of your system for example: 32bit or 64 bit and use file accordingly and click on Run anyway and Yes for install VPN client[Before that install child certificate]**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1t52kjkktfxdz3ci7cnr.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2iqi3b6xkdb3e23annc6.png)

**Click on connect. A new pop-up will open Click on Connectthere also. Now if you have followed the above steps properly the connection will be established successfully**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ebc7wml68z6do3u6puus.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r9mx1h78z2jjxyxx5f08.png)

**In Point-to-site Sessions also, a new session is initiated. Check the IP received from the address pool we specified in configure now tab**

Now try to connect to your virtual machine
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sg9rneut4r2onuv77265.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h8sg1jfrvl365o6npehw.png)
**as per screenshot its showing sucessfully connected**

```
Try to ping another virtual machine in another vnet as created previously.. You will not able to connect..
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hu9dlkk7g1suwrvc10sd.png)

```
So to establish a connection we need gateway transit.
```

## Gateway Transit ?
**Gateway transit enables you to use a peered VNet’s gateway for connecting to on-premises instead of creating a new gateway for connectivity. 
As you increase your workloads in Azure, you need to scale your networks across regions and VNets to keep up with the growth. 
Gateway transit allows you to share an ExpressRoute or VPN gateway with all peered VNets and lets you manage the connectivity in one place. Sharing enables cost-savings and reduction in management overhead.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/922wuj04nfkomad5q5xs.png)

```
Go to Vnet-1 --> peering --> Add
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ms29gihlkeuysrx7yzbb.png)

**This Virtual network
Name it and under virtual netork gateway select : use this vnet gateway**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q3r6pfa2ovqkloc9gpwm.png)

**Remote virtual network
**

- Name it
- under virtual network select Vnet-2
- virtual netork gateway select :use the remote vnet gateway.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eztjvowv4idvgau8y0nl.png)

```
After that you will see a gateway enable status
```

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8re6r2v5s6b3xwqvnp83.png)

**Now you can able to ping another network machine**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/95064uj2w1axbwpnfapd.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ruy9mkejqjpdtr2i2z0d.png)
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a6h52fvj0yiwhgjhto7i.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5oo3uhl9w25egfb8hppm.png)