It all began a few months ago when I started a new job and took over some problems from the previous client engineer. One of those problems was setting up Microsoft’s AlwaysOn VPN. I’m not particularly familiar with Microsoft’s AlwaysOn solution, which is why I had to read up on it at the beginning. I quickly realized that this was not as easy as I had hoped.
The initial situation:
I think that everyone who has dealt with the configuration of AlwaysOn Microsoft will sooner or later come across this article:
We used these scripts to distribute VPN for the Windows 10 devices. This has worked well so far. We use PSADT and MECM (SCCM) for software distribution and have distributed both the DeviceTunnel (split tunnel) and the UserTunnel (full tunnel) to the clients via SCCM (both in the TS and additionally as a “Required” deployment).
The problem:
With Windows 11, the problem was that only the DeviceTunnel was created during setup and installation via the “Required” deployment. The UserTunnel was not available. The script ran without errors (from PSADT), but the tunnel was not present, although no changes were made to the script compared to the deployment of Windows 10.
The script by Richard Hicks has not been changed, only an XML file for the DeviceTunnel and an XML file for the UserTunnel were created. The following Powershell script was used in “Deploy-Application.ps1”:
Pre-Installation:
## <Disconnect Device Tunnel>
rasdial.exe DeviceTunnel /d
## <Remove Device Tunnel>
if (Get-VpnConnection -Name "DeviceTunnel" -AllUserConnection)
{Execute-Process -Path "powershell.exe" -Parameters "-Command & {Remove-VpnConnection DeviceTunnel -force -AllUserConnection}" -Wait}
else {
Write-Host "VPN *DeviceTunnel* doesnt exists"
}
## <Disconnect User Tunnel>
rasdial.exe UserTunnel /d
## <Remove Device Tunnel>
if (Get-VpnConnection -Name "UserTunnel" -AllUserConnection)
{Execute-Process -Path "powershell.exe" -Parameters "-Command & {Remove-VpnConnection UserTunnel -force -AllUserConnection}" -Wait}
else {
Write-Host "VPN *UserTunnel* doesnt exists"
}
Installation:
Execute-Process -Path "powershell.exe" -Parameters "-Command & { & `"$dirFiles\AovpnConnection.ps1 -xmlFilePath $dirFiles\VPNtoDAP_DeviceTunnel_1.1.0.xml -ProfileName 'DeviceTunnel' -DeviceTunnel`"; Exit `$LastExitCode }" -Wait
## <User Tunnel VPNtoDAP Profile>
Execute-Process -Path "powershell.exe" -Parameters "-Command & { & `"$dirFiles\AovpnConnection.ps1 -xmlFilePath $dirFiles\VPNtoDAp_UserTunnel.xml -ProfileName 'UserTunnel' -AllUserConnection`"; Exit `$LastExitCode }" -Wait
I started troubleshooting by reading up on the whole issue thoroughly. I saw various blog entries in which they talked about VPN problems in relation to Windows 11, but these were supposedly fixed by a KB from Microsoft. I could not confirm this.
The Solution:
To begin with, I decided to create a separate installation for the two tunnels within SCCM. At the beginning I did not change anything in the DeviceTunnel except that I used the latest script from Richard Hicks. For the UserTunnel I suddenly came across the following page:
https://github.com/ConfigJon/AlwaysOnVPN/blob/master/New-AovpnUserTunnel.ps1
I used this script and only changed the name of the tunnel and the version within the PS file. I integrated this in the “Deploy-Application.ps1” as follows:
Pre-Installation:
Execute-Process -Path "$PSHome\powershell.exe" -Parameters "-Command & { & `"$dirFiles\Remove-AovpnUserTunnel.ps1 -ProfileName 'UserTunnel'`"; Exit `$LastExitCode }" -Wait
Installation:
Execute-Process -Path "$PSHome\powershell.exe" -Parameters "-Command & { & `"$dirFiles\New-AovpnUserTunnel.ps1 -xmlFilePath $dirFiles\ProfileXML-User_1.2.xml`"; Exit `$LastExitCode }" -Wait
Deployment Settings:
Install behaviour: Install for system
Logon requirement: Only when a user is logged on
… and BAM! IT WORKED!
A few days later, my boss told me I need to add a new IP-Address to the routing table in the XML because an IP changed for the DeviceTunnel. So I thought: “Well, that shouldn’t be a problem because the DeviceTunnel never was a problem”. But I thought wrong.
The next problem
I tried to update the DeviceTunnel by simply removing it and creating it again. This worked as long as the DeviceTunnel was not connected. But as soon as the device was connected to a hotspot or home WiFi, this did not work. The PSADT-Log reported that a connected VPN Tunnel cannot be removed.
After a few hours of troubleshooting, I stumbled across the following Reddit post:
https://www.reddit.com/r/SCCM/comments/h9emsg/aovpn_profile_deployment_with_sccm_lessons_learned/
This article describes exactly this problem. The OP explains that you can change the authentication method so that the DeviceTunnel is disconnected and then you can remove it:
Set-VPNConnection -AllUserConnection -Name "TunnelName01" -AuthenticationMethod EAP
Unfortunately, this didn’t quite work out. The DeviceTunnel then had the status “Action needed” and could not be removed. I then found out that if I clicked on “Retry” several times in the Software Center, the installation suddenly worked. And indeed, if you enter the command “rasdial.exe DeviceTunnel /d” four times (exactly four times!) after changing the authentication method, the DeviceTunnel is disconnected. So I have adapted my script as follows:
Pre-Installation:
#Set a different AuthenticationMethod to disconnect Device Tunnel
if (Get-VpnConnection -Name "DeviceTunnel" -AllUserConnection)
{
Set-VPNConnection -AllUserConnection -Name "DeviceTunnel" -AuthenticationMethod EAP
## <Disconnect Device Tunnel>
rasdial.exe DeviceTunnel /d
Start-Sleep -Seconds 15
rasdial.exe DeviceTunnel /d
Start-Sleep -Seconds 3
rasdial.exe DeviceTunnel /d
Start-Sleep -Seconds 3
rasdial.exe DeviceTunnel /d
Start-Sleep -Seconds 3
}
else
{
Write-Host "VPN *DeviceTunnel* doesnt exists"
}
## <Remove Device Tunnel>
if (Get-VpnConnection -Name "DeviceTunnel" -AllUserConnection)
{Execute-Process -Path "powershell.exe" -Parameters "-Command & {Remove-VpnConnection DeviceTunnel -force -AllUserConnection}" -Wait}
else {
Write-Host "VPN *DeviceTunnel* doesnt exists"
}
Installation:
Execute-Process -Path "powershell.exe" -Parameters "-Command & { & `"$dirFiles\AovpnConnection.ps1 -xmlFilePath $dirFiles\ProfileXML-Device_1.6.xml -ProfileName 'DeviceTunnel' -DeviceTunnel`"; Exit `$LastExitCode }" -Wait
… and finally I was able to update the DeviceTunnel with the new IP-Address in the XML File.
The files and folder structure for DeviceTunnel:
AppDeploymentToolkit
Files
_AovpnConnection.ps1
_ProfileXML-Device_1.6.xml
_Remove-AovpnConnection.ps1
SupportFiles
Deploy.Application.exe
Deploy-Application.exe.config
Deploy-Application.ps1
The files and folder structure for UserTunnel:
AppDeploymentToolkit
Files
_New-AovpnUserTunnel.ps1
_ProfileXML-User.xml
_Remove-AovpnUserTunnel.ps1
SupportFiles
Deploy.Application.exe
Deploy-Application.exe.config
Deploy-Application.ps1
I hope this post is helpful for some of you guys. Have a nice weekend everyone!