Site-to-Site Azure VPN with a Windows RRAS Server

[@kabookeo]

Was going to buy a cheap vpn firewall to use for training with Azure s2s vpn services. This saved me some good change. Thank you!

[@alexandreizefler]

This video was instrumental in solving the problem of communicating with local VMs with Azure environment resources. Thank you very much!

[@Ciraltos]

Glad it helped!

[@BrunoOliveira-kz8lw]

This worked very well, instead of using my RAS as my gateway for the internal network I only added a new static route for Azure vNet IP range using my RAS as gateway.

[@CarlMakesItEasy]

THANK YOU SO MUCH FOR THIS VIDEO! Everyone in my class was having trouble with linking Skytap servers and Azure servers for our project and it's worth A LOT of points. I was able to finally finish the project thanks to this video. Now I've linked the class to it and I'll try to make my own tutorial showing how to link Skytap and Azure for the class project :D

[@Ciraltos]

Glad to help, thanks for sharing!

[@CarlMakesItEasy]

@@Ciraltos Absolutely! You might have saved like half my university class from getting a failing grade xD

[@SuperTurg]

This is very nice instruction with good explanation. I would like to add only one thing: if RRAS located behind NAT, we have to make some changes in Windows register to allow NAT traversal settings. Thank you.

[@Ciraltos]

Thanks for adding that. My RRAS server is also behind a NAT but didn't require that, but good to know in case someone else runs into a problem with their setup.

[@SanyamYadav-kh7cz]

Thanks a lot for this video. I know its quite an old video, but it would be help if you could answer a question - the host '10.0.0.211' that you pinged in 20:32, in whcih subnet of the vnet was it located at Azure end? Do we need some routes set at the vnet to route all outbound traffic from the vnet to the VNG?

[@moechaudhry6412]

This was a great video! Interestingly enough I didn't have to configure anything with NAT with my network. Also, initially I was able to ping from Azure to all my on-premise VMs BUT couldn't do it the other way around UNTIL I turned off Windows Firewall (I made sure I had the ICMO inbound rule enabled.) Anyway. Thanks for sharing. I found it very straightforward and very easy to follow!

[@Ciraltos]

Glad it was helpful! This video was tricky because of all the variables in how a home lab could be set up. I tried to keep it general enough for a wide audience but also explain why I configured the example for my environment. I also have been burned by troubleshooting issues only to find it's the Windows Firewall and ICMP.

[@skatterbrainz]

Great tutorial! Thank you! You could use an Azure Automation runbook or PowerApp job to poll the public IP from your ISP and update the local network gateway IP

[@DownslideWI]

Travis, have you done a video for setting up a Point to Site for an Azure Storage Account? Thanks!

[@carcharodoncarcharias]

Very clear and smooth tutorial. Thanks for that!

[@mllsatyanarayana8145]

Thanks Rob..Really useful one.We can practice Site to Site VPN with out purchasing the vpn device.

[@michaelwaterman3553]

Brilliant stuff. This is exactly my setup and helped me a lot with the configuration. Thanks!!!

[@Ciraltos]

Very welcome!

[@jdf_trades4797]

Great tutorial, I have tried so many tutorials and none worked, because they failed to mentioned 1 step.

[@waltermyersiii]

Excellent walkthrough that worked perfectly. Thanks!!!

[@Ciraltos]

Glad it helped!

[@jagadeeskumarlenin5517]

Hi sir , how I can open an virtual server @17:36 .In my system where i find an virtual server.

[@Ciraltos]

That is the port forwarding interface in my firewall. Each firewall will be a different and port forwarding may be called something else.

[@jagadeeskumarlenin5517]

Thanks for reply

[@HenryTsang]

Thanks for a great tutorial. I managed to get my S2S connection with the RAS on-prem connected. But it seems only my RAS server can talk to the Azure resources (vice versa). But if I have another VM on the same subnet as the RAS server, this VM cannot see Azure nor vice versa. It seems that only the RAS is aware of the Azure presence. I have followed your steps as close as I can. I realize every network situation is different but was hoping you may have an answer? Thank you.

[@arieldelgado2583]

Saved the day. You are the best man!

[@Ciraltos]

Glad to help!

[@nirengamerandtechie3301]

I used this setup it worked well for Ra's server but unable to ping internal network devices from ras server although I have two nic , unable to ping any local devices from Ra's server

[@Southpaw07]

Thank you Travis. Is it possible to simulate a site-to-site by creating two vnets in Azure? if so i would assume the component are 2 GW's, 2 LNG and 2 VPN connections.

[@sreenugaddam1618]

Excellent and it worked for me...

[@donandreas0209]

Hi, great video I set up with success my vpnsite2site using raas server intalled in a vm created from vmware installed on my laptop. Azure VMs are reachable using their private ip from inside the Raas server, But if I want reach them from my laptop directly or from on other VM created on my onprem(laptop) vmware..how can I do?

[@ssdl101]

Thank you Travis ! I followed your instructions and it works. However, my on-prem devices could not connect to the internet , even after I configured the rras server as the proxy server in your video . Instead I have to configure a static route on the router where I added the azure subnet with the RRAS server’s IP address as a gateway in the routing table and that worked .

[@Ciraltos]

Glad to hear you got it to work. I had difficulty putting this video in a context that could be applied to most environments. With all the different options in deploying home labs or networks, there is no one option that would fit all of them.

[@michaelpietrzak2067]

I know it's probably hard to help but I followed all your steps, my connection on both sides shows connected, but from server in my home lab, I cannot connect to a file share using the "connect" function. Shouldn't 445 be allowed over the VPN into Azure resources? (I can connect to my VM in Azure via RDP and it's private IP)

[@Ciraltos]

Try using test-netconnection from the client to verify connectivity. Also verify storage firewall and private endpoint settings if used.

[@AsifAha]

Great Great and Great video

[@kedargiri5397]

how to resolve hostname between on-premises and azure without DNS server.........i have tried opening port 53 on both the servers and place both server hostname on hostfile but i am unable to resolve hostname between two servers

[@Ciraltos]

Host files should work if DNS isn't used. Host files do not require opening port 53.

[@alphabanks]

Travis have you looked at PFSense

[@mk47508]

Hi Travis, thank you for this resourceful video. Could you PLEASE advice on, "Site-to-Site VPN established , but cannot ping or RDP azure VMs" . On-Premise :: All running on VirtuaBox. Two network adaptors added on RRAS server - Internal & Bridged/external System: VBox Internal Network: VBox Bridged/External Network: RRAS Server 192.168.10.23 192.168.0.23 Windows DC/DNS/DHCP Server 192.168.10.10 N/A Azure:: VNet: 10.3.0.0/22 Subnet: 10.3.2.0/24 Windows 2016 VM: 10.3.2.4 -On my ISP provide Hitron router, created port forwarding rule for IPSec ports 500-4500 to 192.168.0.23/RRAS external. -RRAS-->NAT is configured for internal and external NICs(enabled natting). Both Azure and RRAS are connected and I see outgoing traffic (Incoming is zero, however), but still I cannot ping or RDP the Azure private IP 10.3.2.4 . Please advice.

[@mk47508]

its working after adding static route point to Azure Network on demand-dial interface on RRAS console.

[@soundarya9195]

its take among 3 hrs to create a local network gateway what to do bro

[@Ciraltos]

The magic of editing.. Depending on the region and load it can take time for resources to deploy, some take longer then others.

[@nellikondibalaraju1292]

Still come confusion but good explanation

[@MrHimu4000]

Hi, I have tried to create a RRAS server. I have installed virtualbox and created a windows2016 VM in my win10 pc. Installed RRAS role and configured it. My win10 pc, RRAS server and serial over IP device all are getting IP from my home router. AT Home::::::::::::: Home router subnet: 10.0.0.0/24 My win10 pc: 10.0.0.10 RRAS server: 10.0.0.7 (bridged adaptor from virtualbox) Serial over IP device: 10.0.0.20 At Azure side::::::::::::: Address space: 10.10.0.0/16 Subnet: 10.10.1.0/24 gateway subnet: 10.10.0.0/28 Win10 VM private IP: 10.10.1.6 Now I can see connected from RRAS and from Azure side. I can ping and RDP from win2016(RRAS) server to win10 azure VM with private IP(10.10.1.6). I can also ping from azure vo to RRAS win2016 server(10.0.0.7) But I can not ping OR RDP from my host win10 pc to azure VM private IP. I can not ping from azure vo to serial over IP device. The only communication (ping + RDP) happening between RRAS server and azure win10 VM. Even though my local host win10 pc and the serial over IP device in the same subnet 10.0.0.0/24 they have NO communication with azure VM. But I need to access the serial over IP device from azure VM. seems like I am very close. Please help me with your valuable suggestion. Thank you.

[@Ciraltos]

Have you set the default gateway on the local Win 10 computer to the IP of the RRAS server? Or, set that as the next hop in a static route?

[@MrHimu4000]

@@Ciraltos Thanks a lot for the reply. The system is now working fine.

[@mk47508]

Need your help, my scenarios similar to you, could you please ping me on [e-mail]

[@abulaith4485]

Good video but a bit confusing. Thanks