Fixing VPN connectivity

Author: MatthewMcGlynn

Connect/AzureStack.Connect.psm1

@@ -187,7 +187,7 @@ function Add-AzureStackVpnConnection {
         [parameter(HelpMessage="Azure Stack VPN Connection Name such as 'my-poc'")]
         [string] $ConnectionName = "azurestack",
 
-        [parameter(mandatory=$true, HelpMessage="External IP of the Azure Stack NAT VM such as '1.2.3.4'")]
+        [parameter(mandatory=$true, HelpMessage="External IP of the Azure Stack Host such as '1.2.3.4'")]
         [string] $ServerAddress,
 
         [parameter(mandatory=$true, HelpMessage="Administrator password used to deploy this Azure Stack instance")]
@@ -226,18 +226,14 @@ function Connect-AzureStackVpn {
     param (
         [parameter(HelpMessage="Azure Stack VPN Connection Name such as 'my-poc'")]
         [string] $ConnectionName = "azurestack",
-        [Parameter(HelpMessage="The Domain suffix of the environment VMs")]
-        [string] $DomainSuffix = 'azurestack.local',
-        [parameter(HelpMessage="Certificate Authority computer name in this Azure Stack Instance")]
-        [string] $Remote = "azs-ca01",
         [parameter(HelpMessage="Administrator user name of this Azure Stack Instance")]
         [string] $User = "administrator",
         [parameter(mandatory=$true, HelpMessage="Administrator password used to deploy this Azure Stack instance")]
-        [securestring] $Password
+        [securestring] $Password,
+        [parameter(HelpMessage="Indicate whether to retrieve and trust certificates from the environment after establishing a VPN connection")]
+        [bool] $RetrieveCertificates = $true
     )    
 
-    $Domain = $DomainSuffix
-    
     Write-Verbose "Connecting to Azure Stack VPN using connection named $ConnectionName..." -Verbose
 
     $BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)
@@ -248,36 +244,41 @@ function Connect-AzureStackVpn {
 
     $azshome = "$env:USERPROFILE\Documents\$ConnectionName"
 
-    Write-Verbose "Connection-specific files will be saved in $azshome" -Verbose
+    if ($RetrieveCertificates){
+        Write-Verbose "Connection-specific files will be saved in $azshome" -Verbose
 
-    New-Item $azshome -ItemType Directory -Force | Out-Null
+        New-Item $azshome -ItemType Directory -Force | Out-Null
 
-    $UserCred = "$Domain\$User"
-    $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $UserCred, $Password
+        $hostIP = (Get-VpnConnection -Name $ConnectionName).ServerAddress
 
-    Write-Verbose "Retrieving Azure Stack Root Authority certificate..." -Verbose
-    $cert = Invoke-Command -ComputerName "$Remote.$Domain" -ScriptBlock { Get-ChildItem cert:\currentuser\root | where-object {$_.Subject -eq "CN=AzureStackCertificationAuthority, DC=AzureStack, DC=local"} } -Credential $credential
+        $UserCred = ".\$User"
+        $credential = New-Object System.Management.Automation.PSCredential -ArgumentList $UserCred, $Password
 
-    if($cert -ne $null) {
-        if($cert.GetType().IsArray) {
-            $cert = $cert[0] # take any that match the subject if multiple certs were deployed
-        }
+        Write-Verbose "Retrieving Azure Stack Root Authority certificate..." -Verbose
+        $cert = Invoke-Command -ComputerName "$hostIP" -ScriptBlock { Get-ChildItem cert:\currentuser\root | where-object {$_.Subject -like "*AzureStackSelfSignedRootCert*"} } -Credential $credential
 
-        $certFilePath = "$azshome\CA.cer"
+        if($cert -ne $null) {
+            if($cert.GetType().IsArray) {
+                $cert = $cert[0] # take any that match the subject if multiple certs were deployed
+            }
 
-        Write-Verbose "Saving Azure Stack Root certificate in $certFilePath..." -Verbose
+            $certFilePath = "$azshome\CA.cer"
 
-        Export-Certificate -Cert $cert -FilePath $certFilePath -Force | Out-Null
+            Write-Verbose "Saving Azure Stack Root certificate in $certFilePath..." -Verbose
 
-        Write-Verbose "Installing Azure Stack Root certificate for the current user..." -Verbose
-        
-        Write-Progress "LOOK FOR CERT ACCEPTANCE PROMPT ON YOUR SCREEN!"
+            Export-Certificate -Cert $cert -FilePath $certFilePath -Force | Out-Null
 
-        Import-Certificate -CertStoreLocation cert:\currentuser\root -FilePath $certFilePath
-    }
-    else {
-        Write-Error "Certificate has not been retrieved!"
+            Write-Verbose "Installing Azure Stack Root certificate for the current user..." -Verbose
+            
+            Write-Progress "LOOK FOR CERT ACCEPTANCE PROMPT ON YOUR SCREEN!"
+
+            Import-Certificate -CertStoreLocation cert:\currentuser\root -FilePath $certFilePath
+        }
+        else {
+            Write-Error "Certificate has not been retrieved!"
+        }
     }
+
 }
 
 Export-ModuleMember Connect-AzureStackVpn

Connect/README.md

@@ -24,17 +24,13 @@ This allows your client computer to become part of the Azure Stack PoC network s
 The tool will also download root certificate of the targeted Azure Stack PoC instance locally to your client computer. 
 This will ensure that SSL sites of the target Azure Stack installation are trusted by your client when accessed from the browser or from the command-line tools.
 
-To connect to Azure Stack PoC via VPN, first locate the external BGP-NAT01 address of the target installation. 
-If you specified a static IP for the BGP-NAT during deployment of the Azure Stack PoC, then use it in the connection example below. 
+To connect to Azure Stack PoC via VPN, first locate the host IP address of the target installation. 
 
-If you did not specify a static IP then the BGP-NAT was configured with DHCP. In that case, **read the below section** to obtain your BGP-NAT VM IP by using the IP address of the Azure Stack PoC host (which should be known to you after deployment). 
-
-The commands below need to access the Azure Stack PoC host computer and Azure Stack CA, so they need to be trusted hosts in PowerShell. Run PowerShell as administrator and modify TrustedHosts as follows.
+The commands below need to access the Azure Stack PoC host computer, so it needs to be a trusted host in PowerShell. Run PowerShell as administrator and modify TrustedHosts as follows.
 
 ```powershell
 # Add Azure Stack PoC host to the trusted hosts on your client computer
-Set-Item wsman:\localhost\Client\TrustedHosts -Value "<Azure Stack host address>" -Concatenate
-Set-Item wsman:\localhost\Client\TrustedHosts -Value azs-ca01.azurestack.local -Concatenate
+Set-Item wsman:\localhost\Client\TrustedHosts -Value "<Azure Stack host IP address>" -Concatenate
 ```  
 
 For the VPN connection, use the admin password provided at the time of the Azure Stack deployment.
@@ -47,20 +43,12 @@ Then connect your client computer to the environment as follows.
 
 ```powershell
 # Create VPN connection entry for the current user
-Add-AzureStackVpnConnection -ServerAddress <NAT IP> -Password $Password
+Add-AzureStackVpnConnection -ServerAddress <Host IP Address> -Password $Password
 
 # Connect to the Azure Stack instance. This command can be used multiple times.
 Connect-AzureStackVpn -Password $Password
 ```
 
-## Obtain the NAT IP address with the Azure Stack PoC host address
-
-This command is helpful if you do not immediately know the NAT IP of the Azure Stack PoC you are trying to connect to. You must know the host address of your Azure Stack PoC.
-
-```powershell
-$natIp = Get-AzureStackNatServerAddress -HostComputer "<Azure Stack host address>" -Password $Password
-```
-
 
 # Configure Azure Stack PowerShell Environment