--- title: Deploy Access Server on Microsoft Azure Using an ARM Template canonical: https://openvpn.net/as-docs/v3/azure-arm/ product: Access Server Docs description: Deploy OpenVPN Access Server on Azure using an ARM (Azure Resource Manager) template — covers launching the template from the Azure portal, configuring your virtual machine parameters, and completing initial Access Server setup. --- # Deploy Access Server on Microsoft Azure Using an ARM Template ## Overview Deploy OpenVPN Access Server on Microsoft Azure with an [Azure Resource Manager (ARM) template](https://as-portal.openvpn.com/instructions/azure/installation?system=cloud-launcher) generated from the Access Server Hub. Access Server provides several deployment options for Microsoft Azure. This guide covers the **ARM Template** option that allows you to: - Deploy Access Server without manually installing the software. - Configure the Azure VM and networking for your environment. - Connect directly to the web-based Admin Web UI. - Complete initial Access Server configuration using the onboarding wizard. > **Tip** > > Refer to our [system requirements](https://openvpn.net/as-docs/v3/system-requirements.md) to ensure your system works with Access Server. ## 🚀 Deploy Access Server using the ARM template Use the OpenVPN Azure Resource Manager (ARM) template to deploy a preconfigured Access Server virtual machine (VM) and its required Azure resources. The ARM template automates the initial Access Server configuration and provides the Admin Web UI URL and temporary administrator password when deployment completes. 1. Sign in to the [Access Server Hub](https://as-portal.openvpn.com/) on our site or create a new account. 2. Under **Installation**, select **Azure**. 3. Select **ARM Template**. 4. Select the OpenVPN subscription you want to use with the deployment. 5. Select **Launch Now**. 6. Sign in to your Microsoft Azure account if prompted. - Azure opens the ARM template deployment page. ## ⚙️ Configure the Azure deployment 1. Configure the following settings: | **Setting** | **Description** | | --- | --- | | Subscription | Select the Azure subscription for the deployment | | Resource group | Select an existing resource group or create a new one. | | Region | Select the Azure region where you want to deploy Access Server. | | Virtual machine name | Enter a name for the Access Server VM. | | VM architecture | Select the architecture appropriate for your deployment. | | Virtual machine size | Select an available VM size that meets your Access Server capacity and performance requirements. | | OS disk type | Select the storage type for the operating system disk. | | OS disk size | Select the disk size for the Access Server VM. | | Let's Encrypt Certificate | Leave this selected to configure a browser-trusted Let's Encrypt certificate during deployment. | | Admin Username | Enter the administrative username for the Azure VM. The default is `azureuser`. | | SSH public key source | Create a new key pair, select an existing key stored in Azure, or provide an existing public key. | | SSH key | Complete the SSH key configuration for the option you selected. | | Virtual network | Select an existing Azure virtual network or create a new one for the deployment. | | Subnet | Select the subnet where you want to deploy the Access Server VM. | > **Note** > > Azure VM size availability depends on your subscription, region, quota, and current Azure capacity. If your preferred size isn't available, select another suitable VM size or region. 2. Select **Review + Create**. 3. Wait for Azure to validate the template. 4. Review the deployment Summary. 5. Select **Create**. Azure begins deploying Access Server and its required resources. The deployment creates resources such as: - Network security group. - Virtual network. - Public IP address. - Network interface. - Access Server virtual machine. The deployment also generates a temporary password for the default Access Server administrator account. ## 🌐 Get the Admin Web UI sign-in details When the deployment completes: 1. Select the **Outputs** from the left menu. 2. Locate the deployment outputs: - `adminPortal` — the URL for the Access Server Admin Web UI. - `tempPassword` — the temporary password generated for the `openvpn` administrator account. 3. Open the `adminPortal` URL in your browser. 4. Sign in with: - **Username:** `openvpn` - **Password:** The value shown for `tempPassword`. > **Note** > > If you enabled the **Let's Encrypt Certificate** option, Access Server automatically configures a browser-trusted certificate during deployment. If certificate issuance isn't successful, you may see a browser warning for the self-signed certificate. 5. Review the Access Server End User License Agreement (EULA). 6. Select **Agree**. - The onboarding wizard displays for a new Access Server installation. ## 🚀 Walk through the onboarding wizard The onboarding wizard displays the first time you sign in after activation. It guides you through the initial access configuration and helps you test your first VPN connection. 1. Select whether VPN clients should have: - Internet access through Access Server. - Access to private resources in your Azure virtual network. - Both, if appropriate for your deployment. 2. If access to private resources is enabled, review the network CIDRs that Access Server detected. 3. Verify that the detected networks match the Azure virtual networks that VPN users should access. 4. Keep only the networks that VPN users should be allowed to access. 5. Select **Continue**. 6. Review the OpenVPN Connect download offered by the wizard. The wizard displays the download appropriate for the operating system of the device you're currently using. 7. Select **Download**. 8. Install OpenVPN Connect. 9. Return to the onboarding wizard. 10. Select **Continue**. 11. The wizard displays a prompt while it waits for a VPN connection. 12. Launch OpenVPN Connect on your device. 13. Connect using the profile included. 14. Confirm that the VPN connection succeeds. 15. Return to the Admin Web UI. 16. Select **Finish Wizard**. > **Tip** > > You can also close the onboarding wizard by selecting the **X** if you prefer to skip these steps. 17. After completing the wizard, the Admin Web UI opens and presents a short product tour covering: - The Client Web UI - Users - Access Controls - Authentication - Activation ## ⚙️ Next Steps After confirming that users can connect successfully, complete any operating system maintenance and security hardening required for your production deployment. ### 🕒 Change default time zone 1. If the server uses a different time zone than you require, run: ``` sudo dpkg-reconfigure tzdata ``` 2. Follow the prompts to select the appropriate time zone. ### ⏰ Verify time synchronization Accurate system time is important for authentication, logging, certificates, and time-based one-time password (TOTP) authentication. Before installing another NTP service, verify which time synchronization service is already active on the server and configure it according to your operating-system requirements. ### 🔄 Update operating-system software 1. Keep the underlying Linux operating system current with security and software updates. For example, on Ubuntu servers, run: ``` sudo apt-get update sudo apt-get upgrade ``` 2. Review the packages before applying updates in production and reboot the server when required. ### 🛡️ Further security recommendations Review the security guidance that applies to your deployment: - [Tutorial: Keep Access Server Updated](https://openvpn.net/as-docs/v3/tutorials/tutorial--update-access-server.md) — Keep Access Server current with supported security and feature updates. - [Tutorial: How to Change the Password for Your New Administrative Account](https://openvpn.net/as-docs/v3/tutorials/tutorial--change-admin-user-password.md) — Replace the temporary administrative password used during initial setup. - [Tutorial: Harden the Web Server Cipher Suite String](https://openvpn.net/as-docs/v3/tutorials/tutorial--harden-web-server-cipher-suite-string.md) — Restrict the cipher suites offered by the Access Server web services when your security requirements call for additional hardening. - [Tutorial: How to Isolate Access Server's Web Services](https://openvpn.net/as-docs/v3/tutorials/tutorial--isolate-web-services.md) — Restrict access to the web interfaces for deployments that don't require them to be publicly reachable. Not every security recommendation applies to every installation. Review each tutorial against your deployment and security requirements. ## 🔀 Enable IP forwarding (required for use with routing) You need **IP forwarding** when Access Server uses routing rather than NAT to provide access to private Azure networks. If you use NAT and don't require routed return traffic through the Access Server VM, skip this section. To enable IP forwarding: 1. In the Azure portal, search for `network interfaces`. 2. Select **Network interfaces**. 3. Select the network interface attached to the Access Server VM. 4. Select **IP configurations**. 5. Select the toggle to **Enable** IP forwarding. 6. Select **Save**. 7. Record the VM's private IP address. - You'll use the private IP as the next hop when you configure the Azure route table. ## 🔁 Create and assign a routing table (required for use with routing) When you use **Routing** for your Access Server instead of **NAT**, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance. ### Create a route table 1. In the Azure portal, select **Create a resource**. 2. Search for `route table`. 3. Select the Microsoft **Route table** resource. 4. Select **Create**. 5. Select the resource group containing your Access Server deployment. 6. Enter a name for the route table. 7. Select **Review + Create**. 8. Review the settings. 9. Select **Create**. ### Associate the route table with the subnet 1. Navigate to the Access Server VM. 2. Open its virtual network. 3. Under **Settings**, select **Subnets**. 4. Select the subnet used by your computing resources (may be called **default**). 5. For **Route table**, select the route table you created. 6. Select **Save**. 7. Repeat the procedure for other applicable subnets in the virtual network. ### Add the VPN client routes Add routes for the default Access Server VPN client subnets. 1. Open the route table. 2. Under **Settings**, select **Routes**. 3. Select **Add**. 4. Configure the first route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.224.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 5. Save the route. 6. Select **Add** again. 7. Configure the second route: | Setting | Value | | --- | --- | | **Address Prefix** | `172.27.240.0/20` | | **Next hop type** | **Virtual appliance** | | **Next hop address** | The private IP address of the Access Server VM | 8. Save the route. - Traffic destined for the default Access Server VPN client networks can now use the Access Server VM as the **Virtual appliance** next hop. > **Important** > > `172.27.224.0/20` and `172.27.240.0/20` are the default Access Server VPN client subnets used by this configuration. > > If you change the VPN subnets in the Admin Web UI, update the Azure route table to match. --- Prev: [Azure PAYG](https://openvpn.net/as-docs/v3/azure-payg.md) Next: [Azure Tiered](https://openvpn.net/as-docs/v3/azure-tiered.md) Index: https://openvpn.net/as-docs/llms.txt