Azure / Azure/Azure-Landing-Zones
'vpn_protocols' set to 'IkeV2 and OpenVPN' when using AAD Authentication
- Dominant language
- PowerShell
- Stars
- 96
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Issue Type?
Bug
### (Optional) Module Version
0.11.0
### (Optional) Correlation Id
_No response_
### Description
When deploying Point-to-Site VPN Configuration with authentication type 'AAD', the tunnel type is set to 'OpenVpn and IkeV2'.
```
p2s_gateway_vpn_server_configurations = {
(local.p2s_gateway_vpn_server_configuration_key) = {
name = local.p2s_gateway_vpn_server_configuration_name
tags = local.p2s-tags
virtual_hub_key = local.virtual_hub_key
vpn_authentication_types = ["AAD"]
azure_active_directory_authentication = {
audience = "c632b3df-fb67-4d84-bdcf-b95ad541b5c8"
issuer = "https://sts.windows.net/${data.azurerm_client_config.current.tenant_id}/"
tenant = "https://login.microsoftonline.com/${data.azurerm_client_config.current.tenant_id}"
}
}
}
}
```
See screenshot below:

This causes an error when trying to add User Groups to the configuration through the portal:

To fix this add the [vpn_protocols](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/vpn_server_configuration#vpn_protocols-1) argument the azurerm_vpn_server_configuration resource.
Possible fix in p2s-vpn-gateway.tf:
```
resource "azurerm_vpn_server_configuration" "p2s_gateway_vpn_server_configuration" {
for_each = local.p2s_gateway_vpn_server_configurations != null && length(local.p2s_gateway_vpn_server_configurations) > 0 ? local.p2s_gateway_vpn_server_configurations : {}
location = module.virtual_hubs.location[each.value.virtual_hub_key]
name = each.value.name
resource_group_name = module.virtual_hubs.resource_group_name[each.value.virtual_hub_key]
vpn_authentication_types = each.value.vpn_authentication_types
vpn_protocols = each.value.vpn_protocols //Added argument
tags = try(each.value.tags, {})
dynamic "azure_active_directory_authentication" {
for_each = each.value.azure_active_directory_authentication != null ? [each.value.azure_active_directory_authentication] : []
content {
audience = each.value.azure_active_directory_authentication.audience
issuer = each.value.azure_active_directory_authentication.issuer
tenant = each.value.azure_active_directory_authentication.tenant
}
}
dynamic "client_root_certificate" {
for_each = each.value.client_root_certificate != null ? [each.value.client_root_certificate] : []
content {
name = each.value.client_root_certificate.name
public_cert_data = each.value.client_root_certificate.public_cert_data
}
}
}
```
in locals.tf
```
p2s_gateway_vpn_server_configurations = var.p2s_gateway_vpn_server_configurations != null ? {
for key, svr in var.p2s_gateway_vpn_server_configurations : key => {
name = svr.name
virtual_hub_key = svr.virtual_hub_key
vpn_authentication_types = svr.vpn_authentication_types
vpn_protocols = svr.vpn_protocols //Added
client_root_certificate = svr.client_root_certificate
azure_active_directory_authentication = svr.azure_active_directory_authentication
}
}
```
in variables.tf
```
variable "p2s_gateway_vpn_server_configurations" {
type = map(object({
name = string
virtual_hub_key = string
vpn_authentication_types = list(string)
vpn_protocols = list(string)
tags = optional(map(string))
client_root_certificate = optional(object({
name = string
public_cert_data = string
}))
azure_active_directory_authentication = optional(object({
audience = string
issuer = string
tenant = string
}))
}))
default = {}
}
```
Contributor guide
Assessment
This issue has not been assessed yet.