Windows 10: Azure Forced tunnel over a s2s tunnel via VPN gateway is not working

Tutorial – Create & manage a VPN gateway – Azure portal - Azure VPN Gateway Microsoft LearnHow to implement the Azure Forced Tunneling via S2S VPN · Jorge BernhardtWe have a s2s tunnel between our data center PaloAlto FW and a VPN gateway in Azure. We can reach everything fine between the sites. I created a forced tunnel per MS instructions so that all internet traffic for my crosses the Palo Alto FW. If I try to reach the internet from a VM in the tunneled VNet it fails to reach the PA firewall. all other s2s traffic works fine.I created a UDR for 0.0.0.0/0 and included the subnet in

:)

 

Always On VPN Forced Tunnel with exception for Microsoft Teams

Hi Victor

You have three options to solve this.

Split tunnel

You don´t need to specify exceptionroutes. all non local traffic will be routed outside tunnel.

<VPNProfile>

<NativeProfile>

<RoutingPolicyType>SplitTunnel</RoutingPolicyType>

...

</NativeProfile>

</VPNProfile>

Split tunnel with exception route (Similar as you got from support)

If you want to specify your vpn routes in split tunnel you can use
DisableClassBasedDefaultRoute:

<VPNProfile>

<NativeProfile>

<RoutingPolicyType>SplitTunnel</RoutingPolicyType>

<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>

...

</NativeProfile>

...

<Route>

<Address>10.10.1.0</Address> #Route this subnet via internal gateway

<PrefixSiza>24</PrefixSize>

<ExclusionRoute>False</ExclusionRoute>

<Route>

</VPNProfile>

Forced Tunnel with exception route

This might be a better alternative if you want only teams traffic outside of VPN, all other on VPN tunnel.

You then need to add multiple exclusiion route from the list of IP addresses:

https://endpoints.office.com/endpoi...equestId=b10c5ed1-bad1-445f-b386-b919946339a7

<VPNProfile>

<NativeProfile>

<RoutingPolicyType>ForcedTunnel</RoutingPolicyType>

<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>

...

</NativeProfile>

...

<Route>

<Address>13.107.64.0</Address> #Route this subnet via internal gateway

<PrefixSiza>18</PrefixSize>

<ExclusionRoute>True</ExclusionRoute>

<Route>

...

</VPNProfile>

 

Always On VPN Forced Tunnel with exception for Microsoft Teams

Dear Support Forum,

I am working with a client to deploy Always On VPN (AONVPN) using a forced tunnel approach. However the client requires that Microsoft teams traffic be allowed to go directly rather than via the VPN tunnel. So basically all traffic needs to route via the
corporate network with the exception of MS Teams due to performance issues for real-time audio/video. i am wondering what is the best way to achieve this type of routing? any advise will be very helpful.

i am using Windows 10 client, RRAS 2016 Server, and NPS 2016 server.

Regards

victor

 

Is there a more effificent way to connect to VPN tunnels?

Previously, after creating the PPTP VPN tunnel, you could connect to the tunnel by clicking on the network connection icon, selecting the tunnel, and then connect. Now, I have to click on the network connection icon, click on the tunnel to take me to
the VPN window, select the same tunnel again, and then select connect. There has to be a more efficient way?