How to Deploy VPN Profiles in Configuration Manager

How To Deploy VPN Profiles In Configuration Manager For Windows 10 1803 And

I have had both user and device tunnel running at the same time with no issues, both deployed by intune.

Enterprise Mobility and Security Infrastructure Microsoft Always On VPN and DirectAccess, NetMotion Mobility, PKI and MFA.

Hicks Consulting Newsletter My Tweets RSS Feed RSS - Posts RSS - Comments.

While using PowerShell is fine for local testing, it obviously doesnt scale well.

In theory you could deploy the PowerShell script and XML file using System Center Configuration Manager (SCCM), but using Microsoft Intune is the recommended and preferred deployment method.

However, as of this writing Intune does not support device tunnel configuration natively.

The administrator must create a ProfileXML manually and use Intune to deploy it.

To summarize, the client must be running Windows 10 Enterprise edition and be domain-joined.

It must also have a certificate issued by the internal PKI with the Client Authentication EKU in the local computer certificate store.

You can find a sample Windows 10 Always On VPN device tunnel ProfileXML here.

The default security settings for the IKEv2 protocol (required for the device tunnel) are quite poor.

If I roll out the Device Tunnel using a PowerShell script or SCCM (again a PowerShell script) then the Device Tunnel connects with TrustedNetworkDetection and so does the User Tunnel (deployed via Intune) Anyone else seen this Are Microsoft aware.

If you running 18031809 thats been updated since FebruaryMarch, you should have those fixes.

Are you deploying Always On VPN with Intune using the native UI or custom ProfileXML.

How To Deploy VPN Profiles In Configuration Manager For Windows 10 1803 And

I thought the TrustedNetworkDetection was fixed too but this is the first time I have created both User and Device Tunnels via Intune and there seems to be an issue I am running August 19 Cumulative Update for Windows 10 1803 and I am seeing this issue.

The issue does not occur if I create the Device Tunnel with PowerShell and the User Tunnel with Intune only when using Intune for both.

Is this something that others are experiencing others can test.

I have a completely working device tunnel with split tunneling however if i change SplitTunnel to ForceTunnel under the RoutingPolicyType section it fails to install the VPN on the endpoints with an error saying the Parameter is Incorrect.

Im probably missing something but again, super hard to find any good full examples of the configuration file except for on your site.

When using force tunneling you must remove the DisableClassBasedDefaultRoute option and also any routes.

If i tried removing this (which common sense says you should) it failed to install the VPN adapter with a configuration error.

I also had to remove all of the route entries as you mentioned as well.

While it does show a deployment to a user, it also shows the device deployment.

How To Deploy Vpn Profiles In Configuration Manager