Forced Tunnel in XML VPN Profile not Working

Question

Hello, we're using a custom XML Profile for our InTune VPN Profile and the connection doesn't seem to follow the desired Forced Tunnel parameter. When performing a tracert google.com , the traffic does not go across the tunnel. I haven't been able to find any other configuration requirements. Is there something I'm missing? Thank you.&nbsp;XML excerpt:&nbsp;&lt;VPNProfile&gt;&nbsp;&nbsp;&nbsp;&lt;RememberCredentials&gt;true&lt;/RememberCredentials&gt;&nbsp;&nbsp;&nbsp;&lt;AlwaysOn&gt;true&lt;/AlwaysOn&gt;&nbsp;&nbsp;&nbsp;&lt;TrustedNetworkDetection&gt;domain.com&lt;/TrustedNetworkDetection&gt;&nbsp;&nbsp;&nbsp;&lt;DeviceTunnel&gt;false&lt;/DeviceTunnel&gt;&nbsp;&nbsp;&nbsp;&lt;RegisterDNS&gt;true&lt;/RegisterDNS&gt;&nbsp;&nbsp;&nbsp;&lt;DomainNameInformation&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;DomainName&gt;.domain.com&lt;/DomainName&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;DnsServers&gt;10.0.0.10&lt;/DnsServers&gt;&nbsp;&nbsp;&nbsp;&lt;/DomainNameInformation&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;DnsSuffix&gt;domain.com&lt;/DnsSuffix&gt;&nbsp;&nbsp;&nbsp;&lt;RoutingPolicyType&gt;ForceTunnel&lt;/RoutingPolicyType&gt;...&nbsp;&nbsp;

anon4343 · Answer

I think I see now. If I'm referencing the OMA-URI, ./User/Vendor/MSFT/VPNv2, I need to follow the matching tree described at: https://docs.microsoft.com/en-us/windows/client-management/mdm/vpnv2-csp

moe_kinani · Answer

Hi Anon4343&nbsp;&nbsp;Just like you mentioned earlier NativeProfile does not apply on Azure VPN Client. You can force tunneling using two methods, either advertising custom routes in Azure Gateway using&nbsp;Set AzVirtualNetworkGateway to&nbsp;0.0.0.0/1 ,&nbsp;128.0.0.0/1 or including these routes in the config file under&nbsp;&lt;clientconfig&gt; section (screenshot attached).&nbsp;FYI- Internet connectivity will not be provided through the VPN gateway. As a result, all traffic bound for the Internet is dropped.&nbsp;Hope this helps!Moe&nbsp;Configure VPN clients for P2S OpenVPN protocol connections: Azure AD authentication - Azure VPN Gateway | Microsoft Docs&nbsp;Advertise custom routes for point-to-site VPN Gateway clients - Azure VPN Gateway | Microsoft Docs&nbsp;&nbsp;

harm_veenstra · Answer

Anon4343&nbsp;&nbsp;&lt;DeviceTunnel&gt;false&lt;/DeviceTunnel&gt;&lt;LockDown&gt;true&lt;/LockDown&gt;&lt;AlwaysOn&gt;true&lt;/AlwaysOn&gt;&lt;RoutingPolicyType&gt;ForceTunnel&lt;/RoutingPolicyType&gt;&nbsp;this should be included in the &lt;NativeProfile&gt; section, could you try this?

anon4343 · Answer

I don't think that the &lt;NativeProfile&gt; section is being used because we're using the Azure VPN Client.

Forum Discussion

Forced Tunnel in XML VPN Profile not Working

4 Replies

Resources