Enterprise VPN using Windows 10 built-in client?

Hey all,

Can anyone recommend a managed VPN solution which supports the use of the Windows 10 built-in VPN client? We need our clients to be able to connect to a server that has a dedicated public IP so it can be whitelisted to access a restricted resource.

Currently using OpenVPN AS but users are finding the client a bit clunky.

Requirements:

  • Uses Windows 10 built-in VPN client
  • Forced tunnel
  • Azure AD as auth source
  • Certificate based auth
  • Does not require local admin

Many thanks for any ideas.

Not the built in client… But most SSL vpnnsercers are super easy for users to connect to.

i believe most fw support l2tp ipsec vpn plus AD auth (fortigate does)

What about installing remote access on windows server and using nps for security?

We use a Meraki appliance for our security filtering - we’re trying not to introduce any single points of failure. If our office internet went offline then we’d be stuck.

I would LOVE to use always on VPN, but we are a ‘cloud first’ company so no on-prem hardware except WAP, switches and firewall. No AD, no AAD DS, no PKI, no RRAS etc, all the bits needed for that solution.

The sysadmin who has been at the company longer than me has indicated there’s been some challenges with this client and we wanted to make it as easy as possible. Deploying a VPN profile through InTune is ideally where we would be.

I have seen a few which indicate this, we would be using an Azure appliance version though. I’m trying to get a test subscription set up so I can deploy and check them out. Thanks for the Fortigate recommendation.

As far as I know RRAS is unsupported in Azure VMs, plus we are trying to minimise upkeep. Servers mean more patching/maintenance etc.

you can use pfsense , is open source free fw.

Yes agreed, with the appliances there might be the possibility of load balancing; even if there isn’t I’d rather an Azure hosted appliance over a physical one as the VPN server.

I’m unsure if the Meraki appliance can do the forward proxying etc or if it merely connects it into an Azure subnet, testing is required. Thanks for the recommendation.