in this video we configure outbound network address translation
on an azure subnet so all traffic comes from a specific ip
a topic i caught at ignite this year was virtual network
network address translation or nat i've ran into a few situations in the past
where a vendor had locked access to a resource
based on an ip address medical and legal research documentation websites come to
mind but i'm sure there are many other examples
and what about mfa trusted ips these are public ip addresses
listed as trusted sites and excluded from conditional access policies
you may want to extend that feature to your windows virtual desktop environment
so your windows virtual desktop users don't have to use mfa to access
office 365 resources in both cases having known static ip addresses
for the client in azure would be beneficial you can
assign static public ip addresses to a vm and azure
but they cost money and would be difficult to manage for large
environments this is especially true for windows
virtual desktop the session host may share the same public ip
but there's no native way to control that or set a specific ip
before we go any further please take a second to like subscribe and share
and click the bell icon to get notifications of new content or when i
go live in this video we go over using a nag
gateway on a v-net an azure nat gateway provides a static
ip address or ip address ranges for internet traffic
from one or more subnets this is much like
how users access the internet on premises
all users internet activity is now added behind a public ip address
typically on a firewall let's start with how vms and azure behave by default
when a computer on a v-net without a public ip address
or not behind a load balancer connects to the internet
it's not behind an azure public ip this is not configurable
there's no way to guarantee that ip will be the same if the vm is redeployed or
even restarted if a computer is behind a load balancer
or has a public ip address assigned to the nic
that public ip is used for all inbound traffic
with the nat gateway all outbound traffic comes from the gateway static
ips or ip address ranges it doesn't
interfere with inbound connections going to the load balancer or public ip
address assigned to the azure resource there are some things to know about nac
gateways it won't allow inbound connections
there's other azure resources for that multiple subnets in a v-neck can use the
same nat gateway and that gateway can have up to 16
public ip addresses or public ip prefixes or a mix of both
the tcp timeout can be configured between 4 and 120 minutes
there's an option to use availability zones
nat is regional by default although multiple subnets can use in that gateway
a nat gateway cannot span multiple v-nets
and that gateway won't support a subnet if that subnet has
public ips or load balancers with a basic sku attached to it
and there's no support for ipv6 before we get started with the lab here's an
overview of what we're going to do i have a subnet with some windows
virtual desktop session hosts installed on it
i want to exclude those windows virtual desktop session host
from mfa by adding the public ip address to the trusted mfa site list
to learn more about mfa enforcement when connecting to windows virtual desktop
see my previous video on the subject i'm going to enable the nat gateway on my
vnet and subnet and then add the public ip address to
the mfa trusted ip list once added users should not get prompted
for mfa when they're logging into the o365 portal
or any other o365 resource let's get started in the portal
here i'm logged into a session host with windows virtual desktop let's take a
look at the public ip address with ipchicken
it's showing the ip address at 40.69
next let's go to portal.office.com
and i'll sign in as a user on this tenant
and notice it's giving me an mfa prompt i'm going to stop here i don't need to
actually sign in i just needed to see that prompt next let's go to the azure
portal let's get started with adding a nat
gateway to the subnet i'm using windows virtual desktop
session host for this example but it would work the same with any
other server on the subnet let's go to create a resource
and find nat gateway
click on that gateway and create make sure your subscription's correct
and then i'm going to go to the resource groups
i like to put all my network-based resources into a network resource group
so i'll add that you could create a new one too if you wanted
i'm going to give it a name i'll call it wvd
gw
select the region where your v-net is located your v-net and your gateway have
to be in the same region my case is central us i don't need
availability zones but you can select a zone one two or three
and for this example i'll leave the idle timeout to four minutes
we'll go next to outbound ip address
and i'm gonna create a new one i'll call this
wvd pub ip
and notice that the sku and the assignment
are not changeable it has to be a standard sku
and the assignment has to be static so i'll click ok
and next although i'm not going to create one there is an option to create
a new public ip prefix so you can add a whole block of
ip addresses if you'd like and you can do that in
addition to public ip addresses i'll click cancel and move on to subnet
here we're going to select our virtual network i only have one in the
subscription and i only have one subnet but if you
did have multiple you could select multiple or you could select all of them
but in this case i have a simple setup with only one subnet
next i'll go to tags add tags as needed and then we'll go to review and create
and we'll create
the deployment finished and here i am in the resource group
i have the virtual network object that was there before but i've got two new
objects i've got the wvd nat gw for the mad gateway and i've also
got a public ip address so let's go into the nat gateway
from here we can go to subnets under settings to see what subnets it's
attached to and that was what we selected on
deployment you can go into configuration uh here we can set the idle timeout if
we want to change it from four minutes we've got properties we can take a look
at that let's go to outbound ip addresses here it shows the
public ip address and what that ip address is so it's
52.141.223.64 you can add additional public ip
addresses if you need to
or you can add entire ip address prefixes
if you need to
now that that's said i'm going to copy this ip address
let's add that to the mfa trusted site list
we do that by going to azure active directory
we'll go to security name locations and from there
we have this option of pop out for configure mfa trusted sites
and here i'll add the ip address if you have more than one ip address you can
add it here add a slash 32 to indicate one specific
ip address or if you have a range you can add an
entire range in at this point once done i'll click save
i already have the rules set up to enforce mfa for all users
and that also has the trusted ip list added as an excluded location
so now that i updated that list i should be able to go to portal.office.com
from my windows virtual desktop client in azure without requiring mfa
let's go give that a try i'll go back to chrome and first let's
go to ipchicken again
okay here it shows my updated ip address so that is correct that's the new
external ip address next i'll go to portal.office.com
sign in as the same user
i'll select no at the stay signed in page
that worked to let me go in without an mfa prompt
that worked as expected we added a static nat gateway to the subnet and
then added that ip address to the mfa trusted ip list
now users accessing o365 from within my windows virtual desktop environment
are not required to use mfa i hope you found this helpful keep in mind this
example may have been for windows virtual desktop
but there are other use cases as well don't forget to like and subscribe
thanks for watching