Forced Tunnel in XML VPN Profile not Working

[Anon4343]

Hello, we're using a custom XML Profile for our InTune VPN Profile and the connection doesn't seem to follow the desired Forced Tunnel parameter. When performing a tracert google.com , the traffic does not go across the tunnel. I haven't been able to find any other configuration requirements. Is there something I'm missing? Thank you.

XML excerpt:

<VPNProfile>

   <RememberCredentials>true</RememberCredentials>

   <AlwaysOn>true</AlwaysOn>

   <TrustedNetworkDetection>domain.com</TrustedNetworkDetection>

   <DeviceTunnel>false</DeviceTunnel>

   <RegisterDNS>true</RegisterDNS>

   <DomainNameInformation>

    <DomainName>.domain.com</DomainName>

    <DnsServers>10.0.0.10</DnsServers>

   </DomainNameInformation>   

   <DnsSuffix>domain.com</DnsSuffix>

   <RoutingPolicyType>ForceTunnel</RoutingPolicyType>

...

[#2]

@Anon4343 

<DeviceTunnel>false</DeviceTunnel>

<LockDown>true</LockDown>

<AlwaysOn>true</AlwaysOn>

<RoutingPolicyType>ForceTunnel</RoutingPolicyType>

this should be included in the <NativeProfile> section, could you try this?

[#3]

I think I see now. If I'm referencing the OMA-URI, ./User/Vendor/MSFT/VPNv2, I need to follow the matching tree described at: https://docs.microsoft.com/en-us/windows/client-management/mdm/vpnv2-csp

[#4]

I don't think that the <NativeProfile> section is being used because we're using the Azure VPN Client.

[#5]

Hi @Anon4343 

Just like you mentioned earlier NativeProfile does not apply on Azure VPN Client. You can force tunneling using two methods, either advertising custom routes in Azure Gateway using Set AzVirtualNetworkGateway to 0.0.0.0/1 , 128.0.0.0/1 or including these routes in the config file under <clientconfig> section (screenshot attached).

FYI- Internet connectivity will not be provided through the VPN gateway. As a result, all traffic bound for the Internet is dropped.

Hope this helps!

Moe

Configure VPN clients for P2S OpenVPN protocol connections: Azure AD authentication - Azure VPN Gate...

Advertise custom routes for point-to-site VPN Gateway clients - Azure VPN Gateway | Microsoft Docs