Azure Virtual WAN: How to Configure Point-to-Site Internet Breakout

As a beginner in cloud networking, understanding how to manage secure internet access for remote workers can seem daunting. However, using Azure Virtual WAN, you can achieve a secure and efficient Point-to-Site (P2S) internet breakout. This setup allows remote users to connect through a VPN to Azure, providing internet access via a Microsoft public IP address, enhancing security, and simplifying user whitelisting. Let's explore how this is done and the steps to set it up.

Why This Guide Is Helpful for Everyone

This guide is designed to simplify the process of setting up a P2S internet breakout using Azure Virtual WAN. We've made it accessible even for beginners. Here's why it's valuable for everyone:

1. Security: By routing all internet traffic through Azure Firewall, this setup provides a higher level of protection for remote users.

2. Simplified Management: It simplifies the management of user access and internet traffic by using a single, consistent public IP address. This makes tasks like whitelisting and geo-blocking straightforward.

3. Step-by-Step Instructions: Even for individuals who are unfamiliar with cloud networking, the guide provides easy-to-follow, step-by-step directions so they don't feel confused.

4. Practical Application: By understanding and putting this configuration into practice, you build your confidence and skills and get ready for cloud networking issues in the real world.

Key Concepts

Point-to-Site Connection

A P2S connection allows individual devices to connect to your Azure network using a VPN. This is crucial for remote workers who need secure access to company resources.

Azure Virtual WAN

Azure Virtual WAN acts as a virtual router, handling complex routing tasks and providing a central point for managing network traffic.

Secure Virtual Hub

This is a component within Azure Virtual WAN that ensures all traffic is routed securely, often using Azure Firewall for additional protection.

Step-by-Step Guide for Beginners

Deploy a Virtual WAN

To start, you need to deploy a Virtual WAN in Azure. This provides the foundational infrastructure to support your P2S connections. Here are the easy steps to follow:

1. Deploy a Virtual WAN:

   • Go to the Azure portal.

   • Navigate to "Create a resource".

• Search for and select "Virtual WAN".

• Fill in the required details and choose the type and “Standard”.

• Click "Review + create".

• This step sets up the central network hub that will manage all the traffic and connections.

2. Create a Virtual Hub:

   • Within the Virtual WAN resource, select "Hub" from the left menu.

   • Click “New hub".

• Add required details, such as, name, region, Hub private address space, etc. Configure the hub according to your needs.

• Ensure routing preference is set to VPN.

• Once done, go back and click “hub” from the left menu.

• From the top menu “Connect VPN sites”
  On the Connect sites page, configure the settings as shown in the image below.

• Deploy the hub.

• The virtual hub acts as a focal point for your VPN connections, managing the data flow securely and efficiently.

3. Set Up the Firewall:

   • In the Azure Firewall Manager, select "Create firewall policy".

• Configure policies to allow necessary traffic.

• Deploy Azure Firewall with the appropriate SKU (Stock Keeping Unit).

• Setting up the firewall ensures that all traffic is filtered and monitored, providing an added layer of security.

4. Assign Policies to the Virtual Hub:

   • In Firewall Manager, add the firewall policy to your Virtual Hub.

• Ensure the public IP is correctly assigned.

• Assigning policies helps in defining what type of traffic is allowed or blocked, and maintaining control over network security.

5. Enable Internet Security:

   • Open PowerShell on your computer to run the following script. It will enable the InternetSecurityFlag.

   • 

Run the following script:
powershell

$p2sgw = Get-AzP2sVpnGateway -ResourceGroupName "your-resource-group"

Update-AzP2sVpnGateway -ResourceGroupName $p2sgw.ResourceGroupName -name $p2sgw.Name -EnableInternetSecurityFlag

• Enabling internet security ensures that all outbound traffic is properly routed and secured through Azure Firewall.

6. Configure VPN Client:

   • Download the VPN client profile from the Azure portal.

• Modify the configuration file if needed.

• Import the profile into your VPN client.

• Configuring the VPN client allows your remote users to connect securely to the Azure network, ensuring secure internet access.

Why Use Azure Virtual WAN?

Using Azure Virtual WAN for a P2S internet breakout is beneficial for several reasons:

• Security: It provides a secure connection for remote users by routing traffic through Azure Firewall.

• Simplified Management: Managing user access through a single public IP address makes whitelisting and geo-blocking easier.

• Scalability: Azure Virtual WAN is designed to handle large-scale networking needs, making it ideal for growing organizations.

My Personal Opinion

Setting up a Point-to-Site internet breakout through Azure Virtual WAN is a valuable skill for anyone involved in managing cloud networks. This approach not only enhances security by routing traffic through Azure Firewall but also simplifies management by consolidating traffic through a single public IP address. For beginners this may seem complicated at first but the benefits of secure and scalable network management is worth the time. Azure’s features and user interface makes it easy to learn even for those new to cloud networking.

Follow Umesh Pandit

linkedin.com/in/umeshpandit

x.com/umeshpanditax

https://www.linkedin.com/newsletters/umesh-pandit-s-notes-7038805524523483137/