Skip to content

Commit b0f0823

Browse files
PowerShellCrackPowerShellCrack
committed
Fixed hubspoke gateway
1 parent d80b32b commit b0f0823

7 files changed

+599
-95
lines changed

‎CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Change log for AzureSite2SiteVPNLab
22

3+
4+
## 1.4.1 - February 24, 2022
5+
6+
- Added Gateway transit and Remote gateway's settings for peering; fixes communications from onprem to spoke vnet
7+
- Added VM additional parmas for site 1 and 2. Fixed OSType error and domain join creds issue.
8+
-
9+
310
## 1.4.1 - February 18, 2022
411

512
- Fixed VnetSpoke subnet address on 3B-1 and 2 scripts; was calling an array not a single subnet. Future developments will support multiple subnets

‎Step 3B-1. Build Azure Advanced S2S - Region 1.ps1

Lines changed: 56 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,19 @@
1616
7. attach public ip to gateway
1717
8. Create the VPN gateway
1818
9. Create the local network gateway
19-
10. Create the VPN connection
20-
11. Build VyOS VPN Configuration
21-
12. Applies VyOS configurations
22-
13. Check VPN connection
19+
10. Update gateway transit in peering
20+
11. Create the VPN connection
21+
12. Build VyOS VPN Configuration
22+
13. Applies VyOS configurations
23+
14. Check VPN connection
24+
25+
26+
TODO:
27+
28+
- Clean routes in vyos before adding
29+
- Add Routetable in azure back to onprem
30+
31+
#
2332
#>
2433
$ErrorActionPreference = "Stop"
2534
#Requires -Modules Az.Accounts,Az.Resources,Az.Network
@@ -301,7 +310,6 @@ Else{
301310
}
302311
#endregion
303312

304-
305313
#region 8. Setup LNG connection
306314
$LNGBGPParams=@{}
307315
If($UseBGP){
@@ -343,6 +351,36 @@ Else{
343351
#endregion
344352

345353

354+
#https://docs.microsoft.com/en-us/powershell/module/azurerm.network/set-azurermvirtualnetworkpeering?view=azurermps-6.13.0
355+
Write-Host ("Enabling Gateway transit setting for vnet [{0}]..." -f $AzureAdvConfigSiteA.VnetPeerNameAB) -ForegroundColor White -NoNewline
356+
Try{
357+
$HubvNetPeering = Get-AzVirtualNetworkPeering -VirtualNetworkName $vNetA.Name -ResourceGroupName $AzureAdvConfigSiteA.ResourceGroupName -Name $AzureAdvConfigSiteA.VnetPeerNameAB
358+
# Change AllowGatewayTransit property
359+
$HubvNetPeering.AllowGatewayTransit = $True
360+
# Update the virtual network peering
361+
Set-AzVirtualNetworkPeering -VirtualNetworkPeering $HubvNetPeering | Out-Null
362+
Write-Host "Done" -ForegroundColor Green
363+
}
364+
Catch{
365+
Write-Host ("Failed: {0}" -f $_.Exception.message) -ForegroundColor Black -BackgroundColor Red
366+
}
367+
368+
369+
Write-Host ("Enabling Remote Gateway and Traffic forwarding settings for vnet [{0}]..." -f $AzureAdvConfigSiteA.VnetPeerNameBA) -ForegroundColor White -NoNewline
370+
Try{
371+
$SpokevNetPeering = Get-AzVirtualNetworkPeering -VirtualNetworkName $vNetB.name -ResourceGroupName $AzureAdvConfigSiteA.ResourceGroupName -Name $AzureAdvConfigSiteA.VnetPeerNameBA
372+
# Change the UseRemoteGateways property
373+
$SpokevNetPeering.UseRemoteGateways = $True
374+
# Change value of AllowForwardedTraffic property
375+
$SpokevNetPeering.AllowForwardedTraffic = $True
376+
# Update the virtual network peering
377+
Set-AzVirtualNetworkPeering -VirtualNetworkPeering $SpokevNetPeering | Out-Null
378+
Write-Host "Done" -ForegroundColor Green
379+
}
380+
Catch{
381+
Write-Host ("Failed: {0}" -f $_.Exception.message) -ForegroundColor Black -BackgroundColor Red
382+
}
383+
346384
#region 9. Create the VPN connection
347385
$currentGwConnection = Get-AzVirtualNetworkGatewayConnection -Name $AzureAdvConfigSiteA.ConnectionName `
348386
-ResourceGroupName $AzureAdvConfigSiteA.ResourceGroupName -ErrorAction SilentlyContinue
@@ -419,7 +457,8 @@ If($VyOSConfig.ResetVPNConfigs){
419457
$VyOSFinal += @"
420458
#delete current configurations
421459
delete vpn ipsec
422-
delete protocols bgp
460+
delete protocols
461+
delete nat
423462
`n
424463
"@
425464
}
@@ -516,6 +555,17 @@ set nat source rule $($RuleID) source address '$($VyOSConfig.LocalCIDRPrefix)'
516555
"@
517556
}
518557

558+
#If reset is true, all NAT configs will be delete; need to re-add this one
559+
If($VyOSConfig.EnableNAT -and $VyOSConfig.ResetVPNConfigs){
560+
$VyOSLanCmd += @"
561+
562+
#Enable NAT Configuration
563+
set nat source rule 100 outbound-interface eth0
564+
set nat source rule 100 source address '$($VyOSConfig.LocalCIDRPrefix)'
565+
set nat source rule 100 translation address masquerade
566+
"@
567+
}
568+
519569
If($VyOSConfig.ResetVPNConfigs){
520570
$VyOSFinal += @"
521571
`n

‎Step 3B-2. Build Azure Advanced S2S - Region 2.ps1

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,37 @@ Else{
289289
#endregion
290290

291291

292+
#https://docs.microsoft.com/en-us/powershell/module/azurerm.network/set-azurermvirtualnetworkpeering?view=azurermps-6.13.0
293+
Write-Host ("Enabling Gateway transit setting for vnet [{0}]..." -f $AzureAdvConfigSiteB.VnetPeerNameAB) -ForegroundColor White -NoNewline
294+
Try{
295+
$HubvNetPeering = Get-AzVirtualNetworkPeering -VirtualNetworkName $vNetA.Name -ResourceGroupName $AzureAdvConfigSiteB.ResourceGroupName -Name $AzureAdvConfigSiteB.VnetPeerNameAB
296+
# Change AllowGatewayTransit property
297+
$HubvNetPeering.AllowGatewayTransit = $True
298+
# Update the virtual network peering
299+
Set-AzVirtualNetworkPeering -VirtualNetworkPeering $HubvNetPeering | Out-Null
300+
Write-Host "Done" -ForegroundColor Green
301+
}
302+
Catch{
303+
Write-Host ("Failed: {0}" -f $_.Exception.message) -ForegroundColor Black -BackgroundColor Red
304+
}
305+
306+
307+
Write-Host ("Enabling Remote Gateway and Traffic forwarding settings for vnet [{0}]..." -f $AzureAdvConfigSiteB.VnetPeerNameBA) -ForegroundColor White -NoNewline
308+
Try{
309+
$SpokevNetPeering = Get-AzVirtualNetworkPeering -VirtualNetworkName $vNetB.name -ResourceGroupName $AzureAdvConfigSiteB.ResourceGroupName -Name $AzureAdvConfigSiteB.VnetPeerNameBA
310+
# Change the UseRemoteGateways property
311+
$SpokevNetPeering.UseRemoteGateways = $True
312+
# Change value of AllowForwardedTraffic property
313+
$SpokevNetPeering.AllowForwardedTraffic = $True
314+
# Update the virtual network peering
315+
Set-AzVirtualNetworkPeering -VirtualNetworkPeering $SpokevNetPeering | Out-Null
316+
Write-Host "Done" -ForegroundColor Green
317+
}
318+
Catch{
319+
Write-Host ("Failed: {0}" -f $_.Exception.message) -ForegroundColor Black -BackgroundColor Red
320+
}
321+
322+
292323
#region 9. Create the VPN connection
293324
$currentGwConnection = Get-AzVirtualNetworkGatewayConnection -Name $AzureAdvConfigSiteB.ConnectionName `
294325
-ResourceGroupName $AzureAdvConfigSiteB.ResourceGroupName -ErrorAction SilentlyContinue
@@ -328,9 +359,12 @@ Elseif( $null -eq $currentGwConnection)
328359
Else{
329360
Write-Host ("Gateway is not connected! ") -ForegroundColor Red -NoNewline
330361
If($VyOSConfig['ResetVPNConfigs'] -eq $false){
362+
Write-Host "==========================================" -ForegroundColor Black -BackgroundColor Red
363+
Write-Host " WARNING THIS WILL BREAK REGION 1 CONFIGS " -ForegroundColor Black -BackgroundColor Red
364+
Write-Host "==========================================" -ForegroundColor Black -BackgroundColor Red
331365
$ReconfigureVpn = Read-host "Would you like to re-run the router configurations? [Y or N]"
332366
}
333-
If( ($ReconfigureVpn -eq 'Y') -or ($VyOSConfig['ResetVPNConfigs'] -eq $true) )
367+
If( ($ReconfigureVpn -eq 'Y') )
334368
{
335369
Write-Host ("Attempting to update vyos router vpn configurations to use Azure's public IP [{0}]..." -f $azpip.IpAddress) -ForegroundColor Yellow
336370
$Global:RegionBSharedPSK = Get-AzVirtualNetworkGatewayConnectionSharedKey -Name $AzureAdvConfigSiteB.ConnectionName -ResourceGroupName $AzureAdvConfigSiteB.ResourceGroupName
@@ -364,8 +398,9 @@ configure
364398
If($VyOSConfig.ResetVPNConfigs){
365399
$VyOSFinal += @"
366400
#delete current configurations
367-
delete vpn ipsec
368-
delete protocols bgp
401+
delete vpn
402+
delete protocols
403+
delete nat
369404
`n
370405
"@
371406
}
@@ -461,6 +496,17 @@ set nat source rule $($RuleID) source address '$($VyOSConfig.LocalCIDRPrefix)'
461496
"@
462497
}
463498

499+
#If reset is true, all NAT configs will be delete; need to re-add this one
500+
If($VyOSConfig.EnableNAT -and $VyOSConfig.ResetVPNConfigs){
501+
$VyOSLanCmd += @"
502+
503+
#Enable NAT Configuration
504+
set nat source rule 100 outbound-interface eth0
505+
set nat source rule 100 source address '$($VyOSConfig.LocalCIDRPrefix)'
506+
set nat source rule 100 translation address masquerade
507+
"@
508+
}
509+
464510
$VyOSFinal += @"
465511
466512
commit

‎Step 3B-3. Connect Azure Advanced S2S Regions.ps1

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ Catch{
6565
Break
6666
}
6767

68+
69+
6870
# check BGP ip address
6971
If($UseBGP){
7072
$gateway1.BgpSettingsText

‎Step 4A-1. Build Azure VM.ps1

Lines changed: 31 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,13 @@
5454
5555
.EXAMPLE
5656
57-
& '.\Step 4A-1. Build Azure VM.ps1' -VMName DTOLAB-WK21 -OSType Workstation -JoinDomain -Domain CONTOSO.local -Credentials (Get-Credential)
57+
& '.\Step 4A-1. Build Azure VM.ps1' -VMName CONTOSO-WK1 -OSType Workstation -JoinDomain -Domain CONTOSO.local -DomainJoinCreds (Get-Credential)
5858
5959
RESULT: Builds a Windows 10 VM named CONTOSO-WK1 and attempts to join it to domain CONTOSO.local using credentials
6060
6161
.EXAMPLE
6262
63-
& '.\Step 4A-1. Build Azure VM.ps1' -VMName DTOLAB-WK21 -OSType Workstation -JoinDomain -Domain CONTOSO.local -Credentials (Get-Credential) -OU "OU=Workstations,OU=Region1,DC=CONTOSO,DC=LOCAL"
63+
& '.\Step 4A-1. Build Azure VM.ps1' -VMName CONTOSO-WK1 -OSType Workstation -JoinDomain -Domain CONTOSO.local -DomainJoinCreds (Get-Credential) -OU "OU=Workstations,OU=Region1,DC=CONTOSO,DC=LOCAL"
6464
6565
RESULT: Builds a Windows 10 VM named CONTOSO-WK1 and attempts to join it to domain CONTOSO.local in Region 1 workstation OU using credentials
6666
@@ -71,7 +71,7 @@ Param(
7171
[string]$VMName,
7272

7373
[ValidateSet('Workstation', 'Server')]
74-
[string]$OSType,
74+
[string]$OSType = 'Server',
7575

7676
[Parameter(ParameterSetName = 'JoinDomain')]
7777
[switch]$SecureVM,
@@ -87,7 +87,7 @@ Param(
8787
[string]$OU,
8888

8989
[Parameter(Mandatory = $true,ParameterSetName = 'JoinDomain')]
90-
[SecureString]$Credentials
90+
[System.Management.Automation.PSCredential]$DomainJoinCreds
9191
)
9292

9393
$ErrorActionPreference = "Stop"
@@ -272,30 +272,29 @@ $VMConfig = Set-AzVMOperatingSystem -VM $VMConfig -Windows -ComputerName $AzureS
272272
$VMConfig = Add-AzVMNetworkInterface -VM $VMConfig -Id $NIC.Id
273273

274274
#Set VM operating system parameters
275-
Switch($OSType){
276-
277-
'Workstation' {
278-
$VMConfig = Set-AzVMSourceImage -VM $VMConfig `
279-
-PublisherName 'MicrosoftWindowsDesktop' `
280-
-Offer 'Windows-10' `
281-
-Skus 'rs5-enterprise' `
282-
-Version latest
283-
}
284-
'Server' {
285-
$VMConfig = Set-AzVMSourceImage -VM $VMConfig `
286-
-PublisherName 'MicrosoftWindowsServer' `
287-
-Offer 'WindowsServer' `
288-
-Skus '2016-Datacenter' `
289-
-Version latest
290-
}
291-
default {
292-
$VMConfig = Set-AzVMSourceImage -VM $VMConfig `
293-
-PublisherName 'MicrosoftWindowsServer' `
294-
-Offer 'WindowsServer' `
295-
-Skus '2016-Datacenter' `
296-
-Version latest
275+
If($OSType){
276+
Switch($OSType){
277+
278+
'Workstation' {
279+
$VMConfig = Set-AzVMSourceImage -VM $VMConfig `
280+
-PublisherName 'MicrosoftWindowsDesktop' `
281+
-Offer 'Windows-10' `
282+
-Skus 'rs5-enterprise' `
283+
-Version latest
284+
}
285+
'Server' {
286+
$VMConfig = Set-AzVMSourceImage -VM $VMConfig `
287+
-PublisherName 'MicrosoftWindowsServer' `
288+
-Offer 'WindowsServer' `
289+
-Skus '2016-Datacenter' `
290+
-Version latest
291+
}
297292
}
298293
}
294+
Else{
295+
$VMConfig = Set-AzVMSourceImage -VM $VMConfig -PublisherName 'MicrosoftWindowsServer' -Offer 'WindowsServer' -Skus '2016-Datacenter' -Version latest
296+
}
297+
299298

300299

301300

@@ -347,7 +346,6 @@ If($SecureVM){
347346
}
348347
Catch{
349348
Write-Host ("Failed: {0}" -f $_.Exception.message) -ForegroundColor Black -BackgroundColor Red
350-
Break
351349
}
352350
}
353351
Else{
@@ -371,58 +369,21 @@ If($SecureVM){
371369
# Advisor Recommendation (Medium): Windows Defender Exploit Guard should be enabled on machines
372370
# Advisor Recommendation (Low): Azure Backup should be enabled for virtual machines
373371
}
374-
#region Reset VM password (Not working)
375-
<#
376-
#Re-reset password. Sometimes password set during deployment does not work
377-
$VM = Get-AzVM -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -Name $AzureSimpleVM.Name
378-
379-
Get-AzVM -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -VMName $AzureSimpleVM.Name -Status
380-
#must grab the VM Computer Type handler
381-
$typeParams = @{
382-
'PublisherName' = 'Microsoft.Compute'
383-
'Type' = 'VMAccessAgent'
384-
'Location' = $AzureSimpleConfig.LocationName
385-
}
386-
$typeHandlerVersion = (Get-AzVMExtensionImage @typeParams | Sort-Object Version -Descending | Select-Object -first 1).Version
387-
388-
#remove the access extension
389-
Remove-AzVMAccessExtension -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -VMName $AzureSimpleVM.Name -Name 'enablevmaccess' -Force
390-
391-
#build params
392-
$extensionParams = @{
393-
Credential = $Credential
394-
VMName = $AzureSimpleVM.Name
395-
ResourceGroupName = $AzureSimpleConfig.ResourceGroupName
396-
Name = 'enablevmaccess'
397-
Location = $AzureSimpleConfig.LocationName
398-
TypeHandlerVersion = $typeHandlerVersion
399-
}
400-
#add enablevmaccess back with new creds
401-
Set-AzVMAccessExtension @extensionParams
402-
#Set-AzVMAccessExtension -Credential $Credential -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -VMName $AzureSimpleVM.Name `
403-
-Name 'enablevmaccess' -TypeHandlerVersion $typeHandlerVersion -Location $AzureSimpleConfig.LocationName
404-
Update-AzVM -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -VM $VM
405-
Restart-AzVM -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -Name $AzureSimpleVM.Name
406-
407-
#Reset the Remote Desktop Services configuration
408-
#Set-AzVMAccessExtension -ResourceGroupName $AzureSimpleConfig.ResourceGroupName -VMName $AzureSimpleVM.Name -Name "VMRDPAccess" `
409-
-Location $AzureSimpleConfig.LocationName -typeHandlerVersion "2.0" -ForceRerun:$true
410-
#>
411-
#endregion
372+
412373

413374
If($JoinDomain){
414375
#https://docs.microsoft.com/en-us/powershell/module/az.compute/set-azvmaddomainextension?view=azps-7.1.0
415376
If($OU){
416377
$DomainParams = @{
417378
DomainName=$Domain
418-
Credential=$credential
379+
Credential=$DomainJoinCreds
419380
JoinOption=0x00000001
420381
OUPath=$OU
421382
}
422383
}Else{
423384
$DomainParams = @{
424385
DomainName=$Domain
425-
Credential=$credential
386+
Credential=$DomainJoinCreds
426387
JoinOption=0x00000001
427388
}
428389
}
@@ -437,8 +398,8 @@ If($JoinDomain){
437398

438399
}
439400

440-
441-
Write-Host ("Done creating virtual machine [{0}]" -f $AzureSimpleVM.Name) -ForegroundColor Green
442-
Write-Host "=================================================" -ForegroundColor Green
401+
Write-Host "=================================================" -ForegroundColor Black -BackgroundColor Green
402+
Write-Host (" Done creating virtual machine [{0}]" -f $AzureSimpleVM.Name) -ForegroundColor Black -BackgroundColor Green
403+
Write-Host "=================================================" -ForegroundColor Black -BackgroundColor Green
443404

444405
Stop-Transcript

0 commit comments

Comments
 (0)