In a recent post I discussed options for load balancing Windows Server Routing and Remote Access Service (RRAS) in Microsoft Azure for Always On VPN. There are many choices available to the administrator, however the best alternative is to use a dedicated Application Delivery Controller (ADC), or load balancer. The Kemp LoadMaster load balancer is an excellent choice here, as it is easy to configure and deploy. It is also very cost effective and offers flexible licensing plans, including a metered licensing option.
Deploy LoadMaster in Azure
To provision a Kemp LoadMaster load balancer in Microsoft Azure, open the Azure management console and perform the following steps.
1. Click Create Resource.
2. Enter LoadMaster in the search field.
3. Click on LoadMaster Load Balancer ADC Content Switch.
4. Choose an appropriate license model from the Select a software plan drop-down list.
5. Click Create.
Prepare Azure Instance
Follow the steps below to provision the Azure VM hosting the Kemp LoadMaster load balancer.
1. Choose an Azure subscription to and resource group to deploy the resources to.
2. Provide instance details such as virtual machine name, region, availability options, and image size.
3. Select an authentication type and upload the SSH private key or provide a username and password.
4. Click Next:Disks >.
5. Select an OS disk type.
6. Click Next: Networking >.
7. Select a virtual network and subnet for the load balancer.
8. Create or assign a public IP address.
9. Click Review + create.
LoadMaster Configuration
Once the virtual machine has been provisioned, open a web browser and navigate to the VM’s internal IP address on port 8443 to accept the licensing terms.
Next, log in with your Kemp ID and password to finish licensing the appliance.
Finally, log in to the appliance using the username ‘bal’ and the password provided when the virtual machine was configured.
Azure Network Security Group
A Network Security Group (NSG) is automatically configured and associated with the LoadMaster’s network interface when the appliance is created. Additional inbound security rules must be added to allow VPN client connectivity.
In the Azure management console open the properties for the LoadMaster NSG and follow the steps below to configure security rules to allow inbound VPN protocols.
SSTP
1. Click Inbound security rules.
2. Click Add.
3. Choose Any from the Source drop-down list.
4. Enter * in the Source port ranges field.
5. Select Any from the Destination drop-down list.
6. Enter 443 in the Destination port ranges field.
7. Select the TCP protocol.
8. Select the Allow action.
9. Enter a value in the Priority field.
10. Enter a name for the service in the Name field.
11. Click Add.
IKEv2
1. Click Inbound security rules.
2. Click Add.
3. Choose Any from the Source drop-down list.
4. Enter * in the Source port ranges field.
5. Select Any from the Destination drop-down list.
6. Enter 500 in the Destination port ranges field.
7. Select the UDP protocol.
8. Select the Allow action.
9. Enter a value in the Priority field.
10. Enter a name for the service in the Name field.
11. Click Add.
12. Repeat the steps below for UDP port 4500.
Load Balancing SSTP and IKEv2
Refer to the following posts for detailed, prescriptive guidance for configuring the Kemp LoadMaster load balancer for Always On VPN load balancing.
Always On VPN SSTP Load Balancing with Kemp LoadMaster
Always On VPN IKEv2 Load Balancing with the Kemp LoadMaster
Always On VPN Load Balancing Deployment Guide for the Kemp LoadMaster
Summary
Although Windows Server RRAS is not a formally supported workload in Azure, it is still a popular and effective solution for Always On VPN deployments. The Kemp LoadMaster load balancer can be deployed quickly and easily to provide redundancy and increase scalability for larger deployments.
Additional Information
Windows 10 Always On VPN SSTP Load Balancing with Kemp LoadMaster Load Balancers
Windows 10 Always On VPN IKEv2 Load Balancing with Kemp LoadMaster Load Balancers
Windows 10 Always On VPN Load Balancing Deployment Guide for Kemp LoadMaster Load Balancers
Deploying the Kemp LoadMaster Load Balancer in Microsoft Azure
Previously I wrote about 
The Internet Key Exchange version 2 (IKEv2) VPN protocol is the protocol of choice for Windows 10 Always On VPN deployments where the highest levels of security and assurance are required. However, as I’ve written about in the past, often the 
I’m commonly asked “can Windows Server with Routing and Remote Access Service (RRAS) be configured with a single network interface?” This is likely because the official Microsoft documentation references only a multihomed dual NIC configuration, leading many to believe it is a strict requirement.
When configuring Always On VPN, administrators have the option to enable DNS registration for VPN clients. When this option is set, VPN clients will register the IP address assigned to their VPN interface in the internal DNS. This allows client devices to be managed using their hostname from the internal network whenever they are connected remotely.
When deploying Windows 10 Always On VPN using Microsoft Intune, administrators have two choices for configuring VPN profiles. They can use the native Intune user interface (UI) or create and upload a custom ProfileXML. The method chosen will depend on which features and settings are required.
