Subscribe to Access Server on Microsoft Azure — Pay As You Go
Create an Access Server VPN server with Microsoft Azure, where you pay as you go. This quick start guide helps you launch the PAYG offering.
Access Server provides an Azure VPN that you can get up and running within minutes.
From the Azure Marketplace, you can launch Access Server. This VPN, hosted in the cloud, has the following benefits.
📄 Deploy Access Server on Microsoft Azure
Click to install Access Server and select Azure as your deployment option.
Under Azure Deployment Options, click the Azure Marketplace Options tab.
Click Buy with Azure to launch the SaaS Contract option.
Sign in with your Microsoft account.
Select your Plan from the drop-down based on desired connections.
Click Subscribe.
Enter your Project details:
Subscription
This auto populates.
Resource group
Select your group from the drop-down to assign this new image.
Name
Enter a name for your image.
Contract duration
Select between monthly and yearly.
Aut-renew
Select whether to set your plan to auto-renew.
Click Review + subscribe.
Review the product and plan details, then click Subscribe.
The SaaS subscription is in progress and will display a successful subscribed message when complete.
🔑 Configure your Azure account
In the Azure portal, click Configure your account.
You're redirected to the OpenVPN website.
On the OpenVPN site, the Link Your Azure Account to OpenVPN sign-in page appears.
Enter your OpenVPN account email and password, then click Sign In.
Enter your account details and click Confirm.
The page Deploy on Azure marketplace using our Azure Launcher displays.
Click Azure SaaS Subscriptions in the side navigation.
Your Azure SaaS subscription details display.
🖥️ Gather Admin Web UI info from virtual machine output
From the Azure deployment, click Outputs.
The URL for the Admin Web UI is displayed in the adminPortal field, along with the temporary password.
Open your web browser and navigate to the Admin Web UI using the provided IP address, such as:
https://<public_ip_of_instance>/admin
Note
Access Server’s web interface comes with a self-signed certificate. This allows you to sign in to the Admin Web UI right away. Since it’s self-signed, it triggers an expected warning. We recommend adding your own SSL certificate in the Admin Web UI to resolve this.
Enter the admin username, openvpn, and your temporary password displayed in the output.
Once signed in, we recommend changing the password for the openvpn user account in the Admin Web UI.
🛠️ Finish Access Server configuration
We suggest some of these next steps for finishing setup:
We recommend configuring a hostname to provide a stable, user-friendly address for the Admin Web UI, Client Web UI, and VPN connections. For example: vpn.example.com. This provides an easier user experience than remembering the server's IP address.
Refer to Hostname and follow the steps.
Access Server supports using multiple authentication methods for VPN users.
Sign in to the Admin Web UI.
Navigate to Authentication.
Configure the authentication method appropriate for your organization.
Access Server supports:
Local authentication.
PAM.
RADIUS.
LDAP.
SAML.
Access Server can also use multiple authentication systems simultaneously.
Refer to Authentication System for more information.
With your VPN server configured, your users can get connected. Choose one of the options below to connect to the server.
Connection method | Procedure |
|---|---|
Download OpenVPN Connect from the Client Web UI |
|
Download a connection profile |
|
Admin distributes connection profiles or installers | Alternatively, as an admin, you can use these ways to connect your users:
|
Tip
Once connected, a simple test the user can perform is checking their IP address. If internet traffic travels over your encrypted VPN tunnel, the user's IP address changes when they connect to Access Server. If you configure split-tunnel traffic, their IP address remains the same for internet traffic.
In order for your instance to function properly if you use “Routing” as your mode of operation inside Access Server instead of NAT, ensure you turn on IP forwarding:
From the Azure portal, enter network interfaces in the search box at the top.
Select Network interfaces from the search results.
Select the network interface of your Access Server virtual machine.
Click IP configurations.
Click on the toggle to Enable IP forwarding.
Click Save.
The network interface change saves.
Note your private IP address here, as you will need it to create and assign a routing table, as explained below.
When you use “Routing” for your Access Server instead of NAT, ensure you create a routing table on Azure so that traffic to your VPN subnet is directed back to your VPN instance.
Create a route table
Click on Create a resource from your Azure portal.
Search for "route table".
Select the Route table from Microsoft when prompted and click Create.
Select the Resource group with your VPN server.
Enter a name for the routing table (choose any you would like).
Click Review + Create then Create.
Attach the route table to your VM
Navigate to your Access Server virtual machine's dashboard.
Under Networking and Virtual network/subnet click on the Vnet for your VM.
Under Settings, click on Subnets.
Click on the subnet used by your computing resources (may be called default).
Click on the Route table drop-down and select your newly created routing table from the list.
Click Save.
Repeat this step for any additional subnets you may have under the same Vnet that the VPN server needs to communicate with.
Add routes
Now that the routing table is assigned, you need to add routes:
Navigate to your new routing table.
Under Settings of your route table, click Routes.
Click Add.
On the Add route page, enter a name, then the following:
Address Prefix: 172.27.224.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Click OK when done.
Click Add again to add a second record:
Address Prefix: 172.27.240.0/20
Next hop type: Virtual appliance
Next hop address: <enter the Private IP address you have noted from the previous step>
Click OK when done.
You've completed the routing table configuration.
Note
The 172.x.x.x IP addresses above are private IP addresses used by Access Server as the internal DHCP system.
Important
If you change your VPN subnets using the Admin Web UI, ensure you edit your routing table configuration as well.