Join On-Prem NAS zu AD via ADDS without public IP?

[phlip]

Hey there,

I'm having the following scenario:

My institution has  a (non-profit) O365 subscription and manages all users via Azure AD. Now we will get a Synology NAS at one of our sites. We still want to manage users and privileges via Azure AD, so we want to join the NAS via Active Directory Domain Services (ADDS) to our AD domain. 

Therefore, as far as I understand, a VPN (IPSec?) tunnel from the on-site network to a VNET in Azure is needed, so that the NAS can communicate to ADDS, right?

The issue with this is, that the site has no public IP address, as it lays behind (multiple) CGNATs and currently there is no way to get another ISP, which would provide a public IP.

Which options do I have to connect my on-prem network to Azure VNET for communication to ADDS?

Thanks!

[#2]

Hi Phlip,

Azure AD requires to be deployed in a Vnet and therefore will require connectivity between your DSM and the Azure Vnet.

The simplest solution is found here. https://www.synology.com/en-global/knowledgebase/DSM/tutorial/Management/How_to_join_NAS_to_Azure_AD...

This is exactly what I have done with my home network, with the exception I use a point-to-site VPN from my DSM to my Azure VPN Gateway. This article describes a point-to-site VPN. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-...

All the best, Steve