12.1 Remote Access Role, VPN Protocols & Site-to-Site VPN to Azure

Remote Access Role, VPN Protocols & Site-to-Site VPN to Azure

Hybrid enterprise architectures require seamless, secure, and resilient communication channels connecting on-premises data centers, branch offices, remote mobile workforces, and Microsoft Azure virtual networks. Windows Server provides enterprise-grade edge networking through the Remote Access (RRAS) server role and centralized authentication, authorization, and accounting (AAA) via the Network Policy and Access Services (NPAS) role.

This section covers the Remote Access edge itself: deploying Routing and Remote Access Service (RRAS), selecting among the client VPN tunneling protocols, and configuring robust IPsec Site-to-Site (S2S) tunnels to an Azure Virtual Network Gateway with Border Gateway Protocol (BGP). The Network Policy and Access Services (NPAS) role and Network Policy Server RADIUS policy processing are covered in section 12.2.

---

1. Windows Server Remote Access Role Architecture

The Remote Access role in Windows Server unifies several critical perimeter networking and remote connectivity services under a single management surface.

+-----------------------------------------------------------------------------------+
|                         WINDOWS SERVER REMOTE ACCESS ROLE                         |
|                                                                                   |
|   +--------------------------+  +--------------------------+  +-----------------+ |
|   | DirectAccess & VPN (RAS) |  |   Routing & NAT (RRAS)   |  | Web App Proxy   | |
|   |--------------------------|  |--------------------------|  |-----------------| |
|   | - Client-to-Site VPN     |  | - LAN / WAN Routing      |  | - Reverse Proxy | |
|   | - Demand-Dial S2S VPN    |  | - Network Address Trans. |  | - AD FS Pre-auth| |
|   | - IKEv2, SSTP, L2TP/IPsec|  | - RIPv2 & BGP Routing    |  | - Kerberos KCD  | |
|   +--------------------------+  +--------------------------+  +-----------------+ |
+-----------------------------------------------------------------------------------+

Core Role Services

1. DirectAccess and VPN (RAS):
   • Remote Access VPN (Client-to-Site): Enables remote telecommuters to establish encrypted tunnels back to the corporate intranet using Point-to-Point Protocol (PPP) over secure encapsulation.
   • Demand-Dial Site-to-Site (S2S) VPN: Connects disparate physical networks or connects an on-premises data center to an Azure Virtual Network across the public internet.
   • DirectAccess: Legacy bi-directional, always-on IPv6-over-IPv4 transition technology (superseded in modern Zero Trust roadmaps by Microsoft Entra Private Access).
2. Routing:
   • LAN Routing & Static Routes: Routes packets between distinct network interfaces and subnets.
   • Network Address Translation (NAT): Allows multiple internal hosts on private IPv4 address spaces (RFC 1918) to share a single public IP address for outbound internet access.
   • Dynamic Routing Protocols: Supports Border Gateway Protocol (BGP) and Routing Information Protocol (RIPv2) for automated route advertisement and topology convergence.
3. Web Application Proxy (WAP):
   • Sits in the perimeter DMZ to publish internal HTTP/HTTPS web applications using Active Directory Federation Services (AD FS) pre-authentication (covered in Section 12.3).

Installing and Enabling the Remote Access Role via PowerShell

# Install Remote Access role with DirectAccess-VPN and Routing services
Install-WindowsFeature -Name DirectAccess-VPN, Routing -IncludeManagementTools

# Initialize the VPN server configuration for IPv4 addressing
Install-RemoteAccess -VpnType Vpn

# Assign client IP addresses from a static address pool.
# The pool lives on Set-VpnIPAddressAssignment -- NOT on Set-VpnServerConfiguration,
# which only tunes IPsec/tunnel properties. -IPAddressRange takes start, end.
Set-VpnIPAddressAssignment `
    -IPAssignmentMethod StaticPool `
    -IPAddressRange '10.200.50.100', '10.200.50.200' `
    -PassThru

# Switch authentication from local Windows to an external RADIUS (NPS) server.
# -Type accepts ONLY Windows or ExternalRadius. The shared secret is a plain String.
Set-VpnAuthType -Type ExternalRadius -RadiusServer '10.100.1.50' `
    -SharedSecret 'EnterpriseSecret2026!' -PassThru

# Set-VpnAuthType only TOGGLES the authentication type; it cannot add further
# RADIUS servers. Additional servers are added explicitly:
Add-RemoteAccessRadius -ServerName '10.100.1.51' -Purpose Authentication `
    -SharedSecret 'EnterpriseSecret2026!' -PassThru

Exam trap -- the two RRAS authentication values. Set-VpnAuthType -Type accepts exactly Windows and ExternalRadius. RadiusAuthentication is not a value of this parameter -- it is a conflation with Add-RemoteAccessRadius -Purpose Authentication, where Authentication/Accounting/Otp are the legal purposes. Note also that -SharedSecret is typed String and is documented as being supplied in clear text, so wrapping it in ConvertTo-SecureString binds the literal text System.Security.SecureString as the secret and silently breaks RADIUS authentication.

---

2. VPN Tunneling Protocols Comparison

Selecting the correct VPN tunneling protocol requires balancing cryptographic strength, firewall traversal capabilities, client operating system compatibility, and connection persistence.

Protocol Deep Dives

IKEv2 (Internet Key Exchange version 2 / IPsec)

• MOBIKE Technology (RFC 4555): IKEv2 supports Mobility and Multihoming Protocol (MOBIKE). When a remote user switches from an office Wi-Fi network to a mobile 5G hotspot or home broadband, the underlying IPsec Security Association (SA) automatically updates its tunnel endpoints without dropping active TCP connections or requiring re-authentication.
• Performance: Hardware-accelerated AES-NI cryptographic offloading provides the lowest CPU overhead and highest throughput of all VPN protocols.
• Prerequisites: Requires a trusted Computer Certificate issued by an enterprise Public Key Infrastructure (PKI) installed on the VPN server, matching the external Fully Qualified Domain Name (FQDN).

SSTP (Secure Socket Tunneling Protocol)

• Firewall Evasion: Encapsulates Point-to-Point Protocol (PPP) frames inside a standard HTTPS TLS tunnel over TCP port 443. Because TCP 443 is universally open across corporate firewalls, hotel networks, and public Wi-Fi hotspots, SSTP serves as the ultimate fallback for restricted remote environments.
• Certificate Validation: The client must trust the Certificate Authority (CA) that issued the VPN server's SSL certificate. If the Certificate Revocation List (CRL) distribution point is unreachable, the client will terminate the connection with error 0x80092013.

PPTP (Point-to-Point Tunneling Protocol)

• Exam Warning: PPTP relies on MS-CHAPv2 and Microsoft Point-to-Point Encryption (MPPE). MS-CHAPv2 has known cryptographic flaws that allow trivial offline dictionary and hash-cracking attacks. PPTP is disabled by default in hardened baselines and must never be selected in modern enterprise architectures.

---

3. Site-to-Site IPsec VPN to Azure VPN Gateway

Connecting an on-premises Windows Server RRAS router to a Microsoft Azure Route-based Virtual Network Gateway establishes a secure hybrid network bridge.

+-----------------------------------------------------------------------------------+
|                   S2S IPSEC VPN: ON-PREMISES RRAS TO AZURE VNET                   |
|                                                                                   |
|   [ON-PREMISES DATA CENTER]                           [MICROSOFT AZURE]           |
|   +--------------------------+                        +-------------------------+ |
|   | Windows Server 2025 RRAS |                        | Azure VPN Gateway       | |
|   | - Demand-Dial Interface  | ===(IKEv2 / IPsec)===> | - Route-Based (VpnGw1-5)| |
|   | - Public IP: 203.0.113.10|    UDP 500 / UDP 4500  | - Public IP: 52.168.1.5 | |
|   | - Private: 192.168.10.0/24                        | - Private: 10.100.0.0/16| |
|   | - BGP ASN: 65010         | <---(BGP Peering)--->  | - BGP ASN: 65515        | |
|   +--------------------------+     TCP Port 179       +-------------------------+ |
+-----------------------------------------------------------------------------------+

Architecture and Cryptographic Proposals

Azure Route-Based VPN Gateways require IKEv2. A custom IPsec policy must be negotiated matching Azure's cryptographic suites across Phase 1 (Main Mode) and Phase 2 (Quick Mode / Child SA).

# 1. Create a Demand-Dial S2S Interface on the Windows Server RRAS Router
Add-VpnS2SInterface `
    -Name 'Azure-S2S-Tunnel' `
    -Destination '52.168.1.5' `
    -IPv4Subnet @('10.100.0.0/16:100') `
    -AuthenticationMethod PSKOnly `
    -SharedSecret 'PreSharedKeyAzure2026!Secure' `
    -Protocol IKEv2 `
    -Persistent `
    -AdminStatus $true

# 2. Configure Custom IPsec & IKE Cryptographic Parameters matching Azure.
#    -CustomPolicy is its own parameter set: use -EncryptionMethod and
#    -IntegrityCheckMethod. Because the ESP cipher is AEAD (GCMAES256), the
#    authentication transform must be GCMAES256 as well.
Set-VpnServerConfiguration `
    -TunnelType IKEV2 `
    -CustomPolicy `
    -EncryptionMethod GCMAES256 `
    -CipherTransformConstants GCMAES256 `
    -AuthenticationTransformConstants GCMAES256 `
    -IntegrityCheckMethod SHA256 `
    -PfsGroup PFS2048 `
    -DHGroup Group14 `
    -SALifeTimeSeconds 27000 `
    -MMSALifeTimeSeconds 28800 `
    -PassThru

Exam trap -- three RRAS S2S naming pitfalls. (1) Add-VpnS2SInterface -AuthenticationMethod accepts only EAP, MachineCertificates, PSKOnly and MSCHAPv2; there is no PresharedKey value. (2) The cmdlet that carries the custom IPsec policy on Windows Server 2019/2022/2025 is Set-VpnServerConfiguration -- Set-VpnServerIPsecConfiguration was the Windows Server 2012 name and is not the current cmdlet. (3) A custom policy is selected with the -CustomPolicy switch, not by passing Custom to -EncryptionType, whose only values are NoEncryption, RequireEncryption, OptionalEncryption and MaximumEncryption. Likewise the Main Mode lifetime parameter is -MMSALifeTimeSeconds (not -MBLifeTimeSeconds) and the integrity parameter is -IntegrityCheckMethod (not -DataIntegrity).

Dynamic Routing with Border Gateway Protocol (BGP)

In large-scale hybrid environments, static routing creates administrative overhead and lacks automated failover. BGP enables dynamic route exchange between Windows Server RRAS and Azure Virtual Network Gateways.

• Azure Default BGP ASN: 65515 (Reserved private Autonomous System Number).
• On-Premises ASN: Any private 16-bit ASN (e.g., 65010).
• Transport: BGP peers establish a TCP session over TCP port 179 across the established IKEv2 tunnel.

# Install Routing Role Service and Configure BGP Router on Windows Server
Install-WindowsFeature -Name Routing -IncludeManagementTools

# Define Local BGP Router instance
Add-BgpRouter -BgpIdentifier '192.168.10.1' -LocalASN 65010 -IPv4Routing 'Enabled'

# Add Azure VPN Gateway as a BGP Peer
Add-BgpPeer `
    -Name 'AzureVNetGateway' `
    -LocalIPAddress '192.168.10.1' `
    -PeerIPAddress '10.100.254.4' `
    -PeerASN 65515 `
    -OperationMode Mixed `
    -PeeringMode Automatic

# Advertise On-Premises Subnets to Azure
Add-BgpCustomRoute -Network '192.168.10.0/24'

---