Prepare Azure P2S domain deployment

2026-09-08 15:32:07 -06:00
parent 991fc70600
commit a24c25a3fb
18 changed files with 1288 additions and 28 deletions
@@ -8,6 +8,14 @@ param(
    [string]$DomainNetbios = 'LCI',
    [string]$ComputerOuDn,
    [string]$NewComputerName,
+    [ValidateSet('Direct', 'AzureP2S')]
+    [string]$ConnectivityMode = 'Direct',
+    [string]$VpnConnectionName = 'SGU Azure P2S',
+    [string]$VpnProfilePackagePath,
+    [string]$VpnClientCertificatePfxPath,
+    [securestring]$VpnClientCertificatePfxPassword,
+    [string]$VpnClientRootCertificatePath,
+    [string[]]$AzureNetworkPrefixes = @('10.77.0.0/16'),
    [switch]$SkipRestart
 )

@@ -95,6 +103,30 @@ function Test-TcpPort {
    }
 }

+function Connect-SguAzureP2s {
+    param([Parameter(Mandatory)][string]$ConnectionName)
+
+    $connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection `
+        -ErrorAction SilentlyContinue
+    if (-not $connection) {
+        throw "The all-user VPN connection '$ConnectionName' is not installed. Run Install-SguAzureP2sClient.ps1 in this VM first."
+    }
+    if ($connection.TunnelType -notcontains 'Ikev2' -and $connection.TunnelType -ne 'Ikev2') {
+        throw "The VPN connection '$ConnectionName' is not configured for IKEv2."
+    }
+    if ($connection.ConnectionStatus -ne 'Connected') {
+        & "$env:SystemRoot\System32\rasdial.exe" $ConnectionName
+        if ($LASTEXITCODE -ne 0) {
+            throw "Could not connect the Azure P2S profile '$ConnectionName'. Verify the machine certificate and that UDP 500/4500 is permitted by the local network."
+        }
+    }
+    $connection = Get-VpnConnection -Name $ConnectionName -AllUserConnection
+    if ($connection.ConnectionStatus -ne 'Connected') {
+        throw "The Azure P2S profile '$ConnectionName' did not reach Connected state."
+    }
+    return $connection
+}
+
 Assert-Administrator
 $operatingSystem = Get-CimInstance Win32_OperatingSystem
 if ([int]$operatingSystem.ProductType -ne 1) {
@@ -135,9 +167,52 @@ if (-not $runtimeInstaller) {
    throw 'The offline Microsoft .NET 10 x64 runtime installer is missing from the client package.'
 }

-$NetworkInterfaceAlias = Resolve-ClientInterfaceAlias -RequestedAlias $NetworkInterfaceAlias
-Set-DnsClientServerAddress -InterfaceAlias $NetworkInterfaceAlias `
-    -ServerAddresses $DomainControllerIPv4Address.IPAddressToString
+if ($ConnectivityMode -eq 'AzureP2S') {
+    $existingVpnConnection = Get-VpnConnection -Name $VpnConnectionName -AllUserConnection `
+        -ErrorAction SilentlyContinue
+    if (-not $existingVpnConnection) {
+        $installerPath = Join-Path $packageRoot 'Install-SguAzureP2sClient.ps1'
+        if (-not (Test-Path -LiteralPath $installerPath -PathType Leaf)) {
+            throw 'Install-SguAzureP2sClient.ps1 is missing from the client bootstrap package.'
+        }
+        foreach ($vpnInput in @(
+            @{ Name = 'VpnProfilePackagePath'; Value = $VpnProfilePackagePath },
+            @{ Name = 'VpnClientCertificatePfxPath'; Value = $VpnClientCertificatePfxPath },
+            @{ Name = 'VpnClientRootCertificatePath'; Value = $VpnClientRootCertificatePath })) {
+            if ([string]::IsNullOrWhiteSpace([string]$vpnInput.Value)) {
+                throw "$($vpnInput.Name) is required the first time an Azure P2S client is enrolled."
+            }
+        }
+        $vpnInstallParameters = @{
+            VpnProfilePackagePath = $VpnProfilePackagePath
+            ClientCertificatePfxPath = $VpnClientCertificatePfxPath
+            ClientRootCertificatePath = $VpnClientRootCertificatePath
+            ConnectionName = $VpnConnectionName
+            AzureNetworkPrefixes = $AzureNetworkPrefixes
+            DomainControllerIPv4Address = $DomainControllerIPv4Address
+            DomainName = $DomainName
+        }
+        if ($VpnClientCertificatePfxPassword) {
+            $vpnInstallParameters.ClientCertificatePfxPassword = $VpnClientCertificatePfxPassword
+        }
+        & $installerPath @vpnInstallParameters | Out-Null
+    }
+    $vpnConnection = Connect-SguAzureP2s -ConnectionName $VpnConnectionName
+    $nrptDisplayName = "SGU Azure P2S DNS - $DomainName"
+    $nrptRule = Get-DnsClientNrptRule -ErrorAction SilentlyContinue |
+        Where-Object DisplayName -eq $nrptDisplayName |
+        Select-Object -First 1
+    if (-not $nrptRule -or
+        @($nrptRule.NameServers) -notcontains $DomainControllerIPv4Address.IPAddressToString) {
+        throw "The SGU NRPT rule for $DomainName is missing or does not point to $DomainControllerIPv4Address. Re-run Install-SguAzureP2sClient.ps1."
+    }
+    $NetworkInterfaceAlias = $vpnConnection.Name
+}
+else {
+    $NetworkInterfaceAlias = Resolve-ClientInterfaceAlias -RequestedAlias $NetworkInterfaceAlias
+    Set-DnsClientServerAddress -InterfaceAlias $NetworkInterfaceAlias `
+        -ServerAddresses $DomainControllerIPv4Address.IPAddressToString
+}

 if (-not (Test-TcpPort -Address $DomainControllerIPv4Address -Port 5985)) {
    throw "The domain controller at $DomainControllerIPv4Address is not accepting WinRM on TCP 5985. Run the server bootstrap first and verify the selected IP."
@@ -292,6 +367,7 @@ try {
        ComputerOuDn = $ComputerOuDn
        NetworkInterfaceAlias = $NetworkInterfaceAlias
        DomainDnsServerAddresses = @($DomainControllerIPv4Address.IPAddressToString)
+        ConnectivityMode = $ConnectivityMode
        RemoteDesktopPrincipal = "$DomainNetbios\SG-Laboratorio-Usuarios-RDP"
        DotNetRuntimeInstallerPath = $runtimeInstaller.FullName
        RustDeskServerAddress = $serverIdentity.RustDeskServerAddress
@@ -356,6 +432,7 @@ finally {
    }
    Remove-Item -LiteralPath $temporaryRoot -Recurse -Force -ErrorAction SilentlyContinue
    $DomainCredential = $null
+    $VpnClientCertificatePfxPassword = $null
 }

 if ($SkipRestart) {
@@ -365,6 +442,8 @@ if ($SkipRestart) {
        ProviderInstalled = $true
        ClientCertificateRegistered = $true
        BrokerEndpoint = $brokerEndpoint
+        ConnectivityMode = $ConnectivityMode
+        VpnConnectionName = if ($ConnectivityMode -eq 'AzureP2S') { $VpnConnectionName } else { $null }
        RestartRequired = $true
        RustDesk = if ($result) { $result.RustDesk } else { $null }
        EnrollmentResult = $result