{"id":5369,"date":"2023-09-17T18:26:00","date_gmt":"2023-09-17T18:26:00","guid":{"rendered":"https:\/\/www.tsls.co.uk\/?p=5369"},"modified":"2024-04-22T08:56:29","modified_gmt":"2024-04-22T08:56:29","slug":"how-to-create-a-remote-network-into-entra-global-security-access","status":"publish","type":"post","link":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/","title":{"rendered":"How to create a remote network into Entra Global Security Access"},"content":{"rendered":"\n

The following steps detail how to create a direct VPN connection using FortiGate Firewall into the Entra Global Security Access service to protect network traffic of all device within your corporate networks.<\/p>\n\n\n\n

The scenario is focused on a FortiGate Firewall Appliance but other VPN Devices should work in a similar way.<\/p>\n\n\n\n

NB: not all VPN device will work. IKEv2 Phase 2 is limited to support only GCMAES128, GCMAES192, GCMAES256 and not all device will support these cyphers.<\/p>\n\n\n\n

\n
\n
\n
Step<\/span><\/strong><\/td>Screenshot<\/span><\/strong><\/td><\/tr>
Navigate to https:\/\/entra.microsoft.com\/<\/a>  
Expand Global Secure Access
Expand Remote Network  
Click “Create remote network”<\/td>		 \"\" <\/td><\/tr>
Basic Information:   <\/strong>

Name: <Endpoint Name>
Region: <Local Region>  

Click Next<\/td>		\"\"<\/td><\/tr>
Connectivity Information:  <\/strong>

Select Add a Link<\/td>		  \"\"<\/td><\/tr>
Add a Link – General Information <\/strong> 

Link Name: <Name of the connected location>
Device Type: <Your VPN Device Make>
IP Address: <Your VPN Public IP>
Local BGP Address: <Microsoft BGP IP Address which you generate and must not conflict with any existing networks>
Peer BGP Address: <Your Route BGP Address>
Link ASN: <Your Router BGP ASN Address>
Redundancy: <Select as per your requirements>
Bandwidth capacity: <Select you required capacity; 250mbps, 500mbps, 750mbps, 1000mbps>  

Click Next<\/td>		\"\"<\/td><\/tr>
Add a Link – Details Information \u00a0<\/strong>

Protocol: IKEv2 IPSEC\/IKE
Policy: <Default \/ Custom> \u00a0

If custom then the following options will need to be completed: \u00a0

IKE Phase 1: Encryption: <AES128, AES192, AES256, GCMAES128, GCMAES265>
IKEv2 integrity: <SHA256,SHA384, GCMAES128, GCMAES265>
DH Group: <DHGroup14,> \u00a0
IKE Phase 2:
IPSec Encryption: <GCMAES128, GCMAES192, GCMAES256, None>
IPSec Integrity: <GCMAES128, GCMAES192, GCMAES256, SHA256>
PFS Group: <None, PFS1, PFS2, PFS14, PFS2048, PFSMM, SCP256, ECP384>
SA lifetime (seconds): <value from 300 – 86400> \u00a0

Click Next \u00a0

Note: SA IP Range must be configured as 0.0.0.0\/0 – 0.0.0.0\/0<\/td>		    \"\"<\/td><\/tr>
Add a Link – Security   <\/strong>

Pre-shared key (PSK): <enter a key to be used on Entra and on your VPN Device>

Click Save<\/td>		  \"\"<\/td><\/tr>
Connectivity Tab Information: <\/strong> 

Click Next<\/td>		  \"\"<\/td><\/tr>
Traffic Profile: <\/strong> 
Select the traffic profile for this connection<\/td>		\"\"<\/td><\/tr>
Review + Create Information  
<\/strong>
Confirm the information is correct  

Click Create remote network<\/td>		\"\"<\/td><\/tr>
From the main remote network

Select view configuration<\/td>		\"\"<\/td><\/tr>
From the network configuration  

Click Copy and Save<\/td>		\"\"<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

FortiGate Firewall Configuration<\/h2>\n\n\n\n

The following table details the steps to configure a FortiGate Firewall (in this instance a 60E)<\/p>\n\n\n\n

<\/p>\n\n\n\n

Step<\/strong><\/td>Screenshot<\/strong><\/td><\/tr>
Navigate to your routers IP http:\/\/x.x.x.x

Expand VPN
Expand IPsec Tunnel
Click Create New Tunnel

<\/td>		\"\"<\/td><\/tr>
Within the Wizard

Name: VPNtoEntra
Template Type: Custom

Click Next<\/td>		\"\"<\/td><\/tr>
On the Next Screen complete the following:

IP Version: IPv4
IP Address: EntraID VPN
Interface: WAN Port
NAT: Disabled
DPD: On Idle
Method: PSK
Pre-Shared Key: xxxxx
IKE: 2

<\/td>		\"\"<\/td><\/tr>
Phase 1 Proposal
Encryption: AES256
Authentication: SHA256
DH: G14
Key Life: 86400

Phase 2 Proposal
Local Address: 0.0.0.0\/0.0.0.0
Remote Address: 0.0.0.0\/0.0.0.0
Encryption: AES256GCM
Enable PFS: uncheck
Key Lifetime: 27000 (from above)

Next Click OK<\/td>		\"\"<\/td><\/tr>
Configure BGP

Navigate to Network
Expand BGP (if missing add via system\/feature visibility)
Enter your Local AS: (ASN from above)
Under Neighbors
Click Create New
<\/td>		\"\"<\/td><\/tr>
Add in the Azure BGP details:

IP: (Azure BGP from above)
Remote AS: (Azure ASN from above)
Update source: name of your IPSEC tunnel
Enable Enforce eBGP multihop
Enable Activate IPv4
Check Soft reconfiguration
Check Capability: route refresh

Click OK<\/td>		\"\"<\/td><\/tr>
Navigate to Network
Expand BGP (if missing add via system\/feature visibility)

Add in the local networks

Click Apply

<\/td>		\"\"<\/td><\/tr>
Confirm the BGP has established and is not idle<\/td>\"\"<\/td><\/tr>
And confirm that the routes are visible <\/td>\"\"<\/td><\/tr>
Next you will need to config
the firewall policy to allow
the internal traffic to Entra<\/td>		TBC<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Conclusion<\/h2>\n\n\n\n

Make sure the following are in place:<\/p>\n\n\n\n

    \n
  • SA is configured with the routes 0.0.0.0\/0 – 0.0.0.0\/0.<\/li>\n\n\n\n
  • Route is configured for the Entra BGP Peer within the subnet \/32 i.e. 172.16.2.254\/32 (172.16.2.254 being the Microsoft BGP endpoint).<\/li>\n\n\n\n
  • Within BGP make sure enforce eBGP multihop is enabled (if you see packets being RST\/DROP from your router IP to the Azure BGP IP it’s likely because eBGP is not enabled.<\/li>\n\n\n\n
  • Routes to your local network is enabled in BGP<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

    The following steps detail how to create a direct VPN connection using FortiGate Firewall into the Entra Global Security Access service to protect network traffic of all device within your corporate networks. The scenario is<\/p>\n","protected":false},"author":11,"featured_media":5371,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_newsletter_tier_id":0,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[21],"tags":[],"class_list":["post-5369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft"],"jetpack_publicize_connections":[],"yoast_head":"\r\nHow to create a remote network into Entra Global Security Access - TSLS - Luke Smith<\/title>\r\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\r\n<link rel=\"canonical\" href=\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/\" \/>\r\n<meta property=\"og:locale\" content=\"en_GB\" \/>\r\n<meta property=\"og:type\" content=\"article\" \/>\r\n<meta property=\"og:title\" content=\"How to create a remote network into Entra Global Security Access - TSLS - Luke Smith\" \/>\r\n<meta property=\"og:description\" content=\"The following steps detail how to create a direct VPN connection using FortiGate Firewall into the Entra Global Security Access service to protect network traffic of all device within your corporate networks. The scenario is\" \/>\r\n<meta property=\"og:url\" content=\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/\" \/>\r\n<meta property=\"og:site_name\" content=\"TSLS - Luke Smith\" \/>\r\n<meta property=\"article:published_time\" content=\"2023-09-17T18:26:00+00:00\" \/>\r\n<meta property=\"article:modified_time\" content=\"2024-04-22T08:56:29+00:00\" \/>\r\n<meta property=\"og:image\" content=\"http:\/\/www.tsls.co.uk\/wp-content\/uploads\/2023\/10\/VPN.jpg\" \/>\r\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\r\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\r\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\r\n<meta name=\"author\" content=\"Luke Smith\" \/>\r\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Luke Smith\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\r\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/\",\"url\":\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/\",\"name\":\"How to create a remote network into Entra Global Security Access - TSLS - Luke Smith\",\"isPartOf\":{\"@id\":\"https:\/\/www.tsls.co.uk\/#website\"},\"datePublished\":\"2023-09-17T18:26:00+00:00\",\"dateModified\":\"2024-04-22T08:56:29+00:00\",\"author\":{\"@id\":\"https:\/\/www.tsls.co.uk\/#\/schema\/person\/e4d7dac4fe1b3f8df31f3857bb3ebda7\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.tsls.co.uk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to create a remote network into Entra Global Security Access\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.tsls.co.uk\/#website\",\"url\":\"https:\/\/www.tsls.co.uk\/\",\"name\":\"TSLS - Luke Smith\",\"description\":\"- Knowledge - Thoughts - Microsoft -\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.tsls.co.uk\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.tsls.co.uk\/#\/schema\/person\/e4d7dac4fe1b3f8df31f3857bb3ebda7\",\"name\":\"Luke Smith\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.tsls.co.uk\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/29abc50f07a4ebe68cb4f31981884f89b2157d7e4ed63b09631d40c0717faa94?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/29abc50f07a4ebe68cb4f31981884f89b2157d7e4ed63b09631d40c0717faa94?s=96&d=mm&r=g\",\"caption\":\"Luke Smith\"},\"description\":\"I\u2019ve been working with Microsoft Technologies for over 20 years, my main focus now being Microsoft Online Services. I manage the Cloud Services at ElysianIT Limited and as a P-SELLER at Microsoft. I have worked with many organisations from SMC to Enterprise. I\u2019ve been working with Microsoft Technologies since DOS 5.0, to date I have been working on Microsoft\u2019s latest cloud technology Windows Azure, Windows 10 Office 365 and Microsoft SharePoint\",\"sameAs\":[\"http:\/\/www.tsls.co.uk\"],\"url\":\"https:\/\/www.tsls.co.uk\/index.php\/author\/luke\/\"}]}<\/script>\r\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to create a remote network into Entra Global Security Access - TSLS - Luke Smith","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/","og_locale":"en_GB","og_type":"article","og_title":"How to create a remote network into Entra Global Security Access - TSLS - Luke Smith","og_description":"The following steps detail how to create a direct VPN connection using FortiGate Firewall into the Entra Global Security Access service to protect network traffic of all device within your corporate networks. The scenario is","og_url":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/","og_site_name":"TSLS - Luke Smith","article_published_time":"2023-09-17T18:26:00+00:00","article_modified_time":"2024-04-22T08:56:29+00:00","og_image":[{"width":1024,"height":1024,"url":"http:\/\/www.tsls.co.uk\/wp-content\/uploads\/2023\/10\/VPN.jpg","type":"image\/jpeg"}],"author":"Luke Smith","twitter_misc":{"Written by":"Luke Smith","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/","url":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/","name":"How to create a remote network into Entra Global Security Access - TSLS - Luke Smith","isPartOf":{"@id":"https:\/\/www.tsls.co.uk\/#website"},"datePublished":"2023-09-17T18:26:00+00:00","dateModified":"2024-04-22T08:56:29+00:00","author":{"@id":"https:\/\/www.tsls.co.uk\/#\/schema\/person\/e4d7dac4fe1b3f8df31f3857bb3ebda7"},"breadcrumb":{"@id":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.tsls.co.uk\/index.php\/2023\/09\/17\/how-to-create-a-remote-network-into-entra-global-security-access\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.tsls.co.uk\/"},{"@type":"ListItem","position":2,"name":"How to create a remote network into Entra Global Security Access"}]},{"@type":"WebSite","@id":"https:\/\/www.tsls.co.uk\/#website","url":"https:\/\/www.tsls.co.uk\/","name":"TSLS - Luke Smith","description":"- Knowledge - Thoughts - Microsoft -","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.tsls.co.uk\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.tsls.co.uk\/#\/schema\/person\/e4d7dac4fe1b3f8df31f3857bb3ebda7","name":"Luke Smith","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.tsls.co.uk\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/29abc50f07a4ebe68cb4f31981884f89b2157d7e4ed63b09631d40c0717faa94?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/29abc50f07a4ebe68cb4f31981884f89b2157d7e4ed63b09631d40c0717faa94?s=96&d=mm&r=g","caption":"Luke Smith"},"description":"I\u2019ve been working with Microsoft Technologies for over 20 years, my main focus now being Microsoft Online Services. I manage the Cloud Services at ElysianIT Limited and as a P-SELLER at Microsoft. I have worked with many organisations from SMC to Enterprise. I\u2019ve been working with Microsoft Technologies since DOS 5.0, to date I have been working on Microsoft\u2019s latest cloud technology Windows Azure, Windows 10 Office 365 and Microsoft SharePoint","sameAs":["http:\/\/www.tsls.co.uk"],"url":"https:\/\/www.tsls.co.uk\/index.php\/author\/luke\/"}]}},"jetpack_featured_media_url":"https:\/\/www.tsls.co.uk\/wp-content\/uploads\/2023\/10\/VPN.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2gf1k-1oB","_links":{"self":[{"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=5369"}],"version-history":[{"count":7,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5369\/revisions"}],"predecessor-version":[{"id":5715,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/5369\/revisions\/5715"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/media\/5371"}],"wp:attachment":[{"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=5369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=5369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tsls.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=5369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}