Skip to content
Richard "Dick" Tracy edited this page Dec 16, 2022 · 4 revisions

Overview

This lab guide is designed to help anyone that that does not know how to set up a Site-2-Site VPN or a full domain environment with MEM Hybrid Infrastructure (MECM and Intune with CMG). This lab guide will set up a production-like Endpoint Management environment using Azure Compute services with a Azure subscription account, (referred to the Resource Tenant), along with a demo licensed Tenant and your VSE subscription, (referred as the Services Tenant). Then connecting them to a Hyper-V virtual environment, as the on-premises simulation, using a Site-to-Site VPN for a hybrid setup.

Paths

There are a few paths this guide will take you through, however, you can skip to any areas by using the Table of Contents or Navigation Pane.

  • Azure IaaS only lab
  • Hybrid Lab (Using S2S VPN)
  • Autopilot with Hybrid join capabilities.
  • Co-Management over Intranet and Internet
  • Azure Virtual Desktop
  • Automation and DSC configurations
  • Certificate Based Authentication with Onprem Certificate Authority

Learning Paths

Besides Microsoft documentation and LinkedIn Learning, there are tons of content out there that focuses on Endpoint Management. Here is a collection of content that is very helpful:

Design

The below shows a visual of what your lab could look like.

Pages

Network Checklist

This checklist is to be used during the networking configuration. Values that are prefilled in can be used, but they can be changed if needed; make sure you read the comments.

Name Values Comment
Lab Name Lab
Domain Name It is best to create a unique domain
Azure Hub Name Lab-Hub-Subnet1
Azure Hub CIDR 10.10.0.0/16
Azure Hub Subnet 1 10.10.0.0/24 Specify a space within Hub's CIDR
Azure Hub Gateway 10.10.200.0/26 Specify a space within Hub's CIDR Subnet but does not conflict with subnet 1
Azure Spoke Name Lab-Spoke-Subnet1
Azure Spoke CIDR 10.20.0.0/16
Azure Spoke Subnet 1 10.20.0.0/24 Specify space within Spoke's
Azure Spoke Subnet 2 10.20.1.0/27 Bastion Subnet
Azure VPN ASN Port 65010
IPSec Shared Key This will be generated when setting up VYOS router.
Azure Gateway Public IP This can be retrieved once a gateway has been created in Azure.
Home Public IP The home network where the device connected to will be hosting Hyper-V guests, go to: https://ipinfo.io/json .
Hyper-V Subnet 1 10.100.1.0/24 Cannot conflict with Azure subnets
Hyper-V Subnet 2 10.100.2.0/24 Cannot conflict with Azure subnet
Azure VM: Domain 10.20.0.1 Use this to configure Azure
Controller IP subnets internal DNS. If multiple DC's are created, each IP will need to be added.
Clone this wiki locally