Add a Azure WebApp to an Existing VPN using a Point-to-Site connection (RM Powershell)

Question

I have hunted around for an answer to this, but I am not having much luck. All the articles I can find are either setting up a Point-to-Site or are instructions for classic Azure, not Azure 2.0 (Resource Group)

Currently, we are dialing up a whole new resource group everytime we do a new built. This consists of Web apps and SQL DBs. When we have a new build we start up the new and del the old resource group. Simple. To minimize the start-up time we have a static resource group that isn't deleted that houses the VPN connection to our on Prem resources.

The problem I'm having is when I add the new websites using AzureRM Powershell cmd's to the Point-to-site it says it's successful. The Azure Portal says its good but it does let me communicate. If I remove and add it from one of the 8 WebApps they all start working.

I am out of ideas. Any help would be greatly appreciated.

Azure VPN

Below is the function I have put togeather from what I can find out there.

function AddExistingVnet{
param(
    [string] $subscriptionId,
    [string] $resourceGroupName,
    [string] $webAppName

)

$Vnet = Get-AzureRmVirtualNetwork | Where-Object {$_.ResourceGroupName -like "*Static*"}

IF($Vnet.Name.count -gt 1) {write-host 'Two or networks have been returned. Unable to continue ' return}

    $gatewaySubnet = $vnet.Subnets | Where-Object { $_.Name -eq "GatewaySubnet" }
    $vnetName = $vnet.Name
    $uriParts = $gatewaySubnet.IpConfigurations[0].Id.Split('/')
    $gatewayResourceGroup = $uriParts[4]
    $gatewayName = $uriParts[8]
    $gateway = Get-AzureRmVirtualNetworkGateway -ResourceGroupName $vnet.ResourceGroupName -Name $gatewayName

    Write-Host "Creating App association to VNET"
    $propertiesObject = @{
     "vnetResourceId" = "/subscriptions/$($subscriptionId)/resourceGroups/$($vnet.ResourceGroupName)/providers/Microsoft.Network/virtualNetworks/$($vnetName)"
    }

    $virtualNetwork = New-AzureRmResource -Location $location -Properties $PropertiesObject -ResourceName "$($webAppName)/$($vnet.Name)" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections" -ApiVersion 2015-08-01 -ResourceGroupName $resourceGroupName -Force

# Now finish joining by getting the VPN package and giving it to the App
Write-Host "Retrieving VPN Package and supplying to App"
$packageUri = Get-AzureRmVpnClientPackage -ResourceGroupName $vnet.ResourceGroupName -VirtualNetworkGatewayName $gateway.Name -ProcessorArchitecture Amd64

# Put the VPN client configuration package onto the App
$PropertiesObject = @{
"vnetName" = $vnet.Name; "vpnPackageUri" = $packageUri
}

New-AzureRmResource -Location $location -Properties $PropertiesObject -ResourceName "$($webAppName)/$($vnet.Name)/primary" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections/gateways" -ApiVersion 2015-08-01 -ResourceGroupName $resourceGroupName -WarningAction silentlyContinue -Force 

}

Logged a Case with Azure support and so far they seem to be stuck. They had one fix which didn't help fix the VPN, but cleared up one of the minor problems. If you are getting a "loading" on the cert sync in the azure web console it can be caused by the length of your WebApp being over 42 characters long. — Latham

Latham Latham · Accepted Answer · 2016-07-07T06:17:07

So after 2 weeks of going back and forth with Microsoft (had a really good guy Charles) we managed to find the problem.

When requesting

$packageUri = Get-AzureRmVpnClientPackage -ResourceGroupName $vnet.ResourceGroupName -VirtualNetworkGatewayName $gateway.Name -ProcessorArchitecture Amd64

It was giving me an output of:

"https://mdsbrketwprodsn1prod.blob.core.windows.net/cmakexe/xxx~xxx/amd64/xxxx~xxxx&sp=r&fileExtension=.exe"

For some reason (that Microsoft could explain) why it kept adding in " to the beginning and end of the variable.

I find it odd that it lets the script work with " and allows the WebApps to join to the VPN.

Any why here is the fix which basicly removes the " from the begining and end of $packageUri :

$packageUri = $packageUri.ToString(); 
$packageUri = $packageUri.Substring(1, $packageUri.Length-2);

So hope that helps someone else out there who is banging there head agaist the same problem.

Here is the complete function if any one is intrested:

function AddExistingVnet{
    param(
        [string] $subscriptionId,
        [string] $resourceGroupName,
        [string] $webAppName

    )


$Vnet = Get-AzureRmVirtualNetwork | Where-Object {$_.ResourceGroupName -like "*Static*"}


IF($Vnet.Name.count -gt 1) {write-host 'Two or networks have been returned. Unable to continue ' return}

        $gatewaySubnet = $vnet.Subnets | Where-Object { $_.Name -eq "GatewaySubnet" }
        $vnetName = $vnet.Name
        $uriParts = $gatewaySubnet.IpConfigurations[0].Id.Split('/')
        $gatewayResourceGroup = $uriParts[4]
        $gatewayName = $uriParts[8]
        $gateway = Get-AzureRmVirtualNetworkGateway -ResourceGroupName $vnet.ResourceGroupName -Name $gatewayName

        $webApp = Get-AzureRmResource -ResourceName $webAppName -ResourceType "Microsoft.Web/sites" -ApiVersion 2015-08-01 -ResourceGroupName $resourceGroupName
        $location = $webApp.Location

        Write-Host "Creating App association to VNET"
        $propertiesObject = @{
         "vnetResourceId" = "/subscriptions/$($subscriptionId)/resourceGroups/$($vnet.ResourceGroupName)/providers/Microsoft.Network/virtualNetworks/$($vnetName)"
        }

        $virtualNetwork = New-AzureRmResource -Location $location -Properties $PropertiesObject -ResourceName "$($webAppName)/$($vnet.Name)" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections" -ApiVersion 2015-08-01 -ResourceGroupName $resourceGroupName -Force

    # Now finish joining by getting the VPN package and giving it to the App
    Write-Host "Retrieving VPN Package and supplying to App"
    $packageUri = Get-AzureRmVpnClientPackage -ResourceGroupName $vnet.ResourceGroupName -VirtualNetworkGatewayName $gateway.Name -ProcessorArchitecture Amd64

    $packageUri = $packageUri.ToString(); 
    $packageUri = $packageUri.Substring(1, $packageUri.Length-2);

    # Put the VPN client configuration package onto the App
    $PropertiesObject = @{
    "vnetName" = $vnet.Name; "vpnPackageUri" = $packageUri.ToString()
    }
    $date = Get-Date -format "HH:mm tt"

    New-AzureRmResource -Location $location -Properties $PropertiesObject -ResourceName "$($webAppName)/$($vnet.Name)/primary" -ResourceType "Microsoft.Web/sites/virtualNetworkConnections/gateways" -ApiVersion 2015-08-01 -ResourceGroupName $resourceGroupName -WarningAction silentlyContinue -Force  

}

Enjoy

Add a Azure WebApp to an Existing VPN using a Point-to-Site connection (RM Powershell)

1 Answers