Skip to content

Commit 88c5248

Browse files
henry416henry416
authored
Multiple Radius Servers for VPN scenario (#11550)
* multiple radius initial commit * new cmdlet * cortex scenario * updated tests * rebased and PR comments * fixed test issue * reworked parametersets * revert Set test * supress a junk secret * multiple radius initial commit * new cmdlet * cortex scenario * updated tests * rebased and PR comments * fixed test issue * reworked parametersets * revert Set test * supress a junk secret * only allow one type of radius to be set * help files * filled in MD file * suppress exception * suppress other cmdlet signature issue * fix * reset static analysis and fixed new cmdlet for default parameter * merged signatureissue fix * fixed typo * removed RemoveAzureSecurityPartnerProviderCommand exception as per PRcomments * Revert "removed RemoveAzureSecurityPartnerProviderCommand exception as per PRcomments" This reverts commit b09407e.
1 parent f111bf0 commit 88c5248

20 files changed

+9436
-84
lines changed

‎src/Network/Network.Test/ScenarioTests/VirtualNetworkGatewayTests.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,14 @@ public void VirtualNetworkGatewayOpenVPNAADAuthTest()
108108
TestRunner.RunTestScript("Test-VirtualNetworkGatewayOpenVPNAADAuth");
109109
}
110110

111+
[Fact]
112+
[Trait(Category.AcceptanceType, Category.CheckIn)]
113+
[Trait(Category.Owner, NrpTeamAlias.brooklynft_subset3)]
114+
public void VirtualNetworkGatewayRadiusTest()
115+
{
116+
TestRunner.RunTestScript("Test-VirtualNetworkGatewayRadius");
117+
}
118+
111119
[Fact]
112120
[Trait(Category.AcceptanceType, Category.CheckIn)]
113121
[Trait(Category.Owner, NrpTeamAlias.brooklynft_subset3)]

‎src/Network/Network.Test/ScenarioTests/VirtualNetworkGatewayTests.ps1

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ function Test-SetVirtualNetworkGatewayCRUD
291291
$gw1ipconfBgp1 = New-AzIpConfigurationBgpPeeringAddressObject -IpConfigurationId $ipconfigurationId1 -CustomAddress $addresslist1
292292
$gateway = Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gateway -IpConfigurationBgpPeeringAddresses $gw1ipconfBgp1
293293
Assert-AreEqual $ipconfigurationId1 $gateway.BgpSettings.BGPPeeringAddresses[0].IpConfigurationId
294-
294+
295295
# Tags
296296
$gateway = Set-AzVirtualNetworkGateway -VirtualNetworkGateway $gateway -Tag @{ testtagKey="SomeTagKey"; testtagValue="SomeKeyValue" }
297297
Assert-AreEqual 2 $gateway.Tag.Count
@@ -648,6 +648,80 @@ function Test-VirtualNetworkGatewayIkeV2
648648
}
649649
}
650650

651+
<#
652+
.SYNOPSIS
653+
Virtual network gateway P2S radius API test
654+
#>
655+
function Test-VirtualNetworkGatewayRadius
656+
{
657+
# Setup
658+
$rgname = Get-ResourceGroupName
659+
$rname = Get-ResourceName
660+
$domainNameLabel = Get-ResourceName
661+
$vnetName = Get-ResourceName
662+
$publicIpName = Get-ResourceName
663+
$vnetGatewayConfigName = Get-ResourceName
664+
$rglocation = Get-ProviderLocation ResourceManagement
665+
$resourceTypeParent = "Microsoft.Network/virtualNetworkGateways"
666+
$location = Get-ProviderLocation $resourceTypeParent
667+
668+
try
669+
{
670+
# Create the multiple radius servers settings
671+
#[SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine")]
672+
$radiuspd = ConvertTo-SecureString -String "radiuspd" -AsPlainText -Force
673+
$radiusServer1 = New-AzRadiusServer -RadiusServerAddress 10.1.0.1 -RadiusServerSecret $radiuspd -RadiusServerScore 30
674+
$radiusServer2 = New-AzRadiusServer -RadiusServerAddress 10.1.0.2 -RadiusServerSecret $radiuspd -RadiusServerScore 1
675+
$radiusServer3 = New-AzRadiusServer -RadiusServerAddress 10.1.0.3 -RadiusServerSecret $radiuspd -RadiusServerScore 15
676+
$radiusServers = @( $radiusServer1, $radiusServer2 )
677+
678+
# Create the resource group
679+
$resourceGroup = New-AzResourceGroup -Name $rgname -Location $rglocation -Tags @{ testtag = "testval" }
680+
681+
# Create the Virtual Network
682+
$subnet = New-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -AddressPrefix 10.0.0.0/24
683+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
684+
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname
685+
$subnet = Get-AzVirtualNetworkSubnetConfig -Name "GatewaySubnet" -VirtualNetwork $vnet
686+
687+
# Create the IP config
688+
$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Dynamic -DomainNameLabel $domainNameLabel
689+
$vnetIpConfig = New-AzVirtualNetworkGatewayIpConfig -Name $vnetGatewayConfigName -PublicIpAddress $publicip -Subnet $subnet
690+
691+
# Create & Get virtualnetworkgateway
692+
New-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname -location $location -IpConfigurations $vnetIpConfig -GatewayType Vpn -VpnType RouteBased -EnableBgp $false -GatewaySku VpnGw1 -VpnClientAddressPool 201.169.0.0/16 -VpnClientProtocol "IkeV2" -RadiusServerList $radiusServers
693+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
694+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers.Count 2
695+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[0].RadiusServerAddress $radiusServer1.RadiusServerAddress
696+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[0].RadiusServerScore $radiusServer1.RadiusServerScore
697+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[1].RadiusServerAddress $radiusServer2.RadiusServerAddress
698+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[1].RadiusServerScore $radiusServer2.RadiusServerScore
699+
700+
# Update gateway to singular radius
701+
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $actual -VpnClientAddressPool 201.169.0.0/16 -VpnClientProtocol "IkeV2" -RadiusServerAddress 10.1.0.2 -RadiusServerSecret $radiuspd
702+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
703+
Assert-Null $actual.VpnClientConfiguration.RadiusServers
704+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServerAddress 10.1.0.2
705+
706+
# Update gateway radius settings
707+
$radiusServers = @($radiusServer3, $radiusServer1)
708+
Set-AzVirtualNetworkGateway -VirtualNetworkGateway $actual -VpnClientAddressPool 201.169.0.0/16 -VpnClientProtocol "IkeV2" -RadiusServerList $radiusServers
709+
$actual = Get-AzVirtualNetworkGateway -ResourceGroupName $rgname -name $rname
710+
Assert-Null $actual.VpnClientConfiguration.RadiusServerAddress
711+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers.Count 2
712+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[0].RadiusServerAddress $radiusServer3.RadiusServerAddress
713+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[0].RadiusServerScore $radiusServer3.RadiusServerScore
714+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[1].RadiusServerAddress $radiusServer1.RadiusServerAddress
715+
Assert-AreEqual $actual.VpnClientConfiguration.RadiusServers[1].RadiusServerScore $radiusServer1.RadiusServerScore
716+
}
717+
finally
718+
{
719+
# Cleanup
720+
Clean-ResourceGroup $rgname
721+
}
722+
}
723+
724+
651725
<#
652726
.SYNOPSIS
653727
Virtual network gateway P2S OpenVPN API test

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.VirtualNetworkGatewayTests/VirtualNetworkGatewayRadiusTest.json

Lines changed: 8873 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/Az.Network.psd1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ CmdletsToExport = 'Add-AzApplicationGatewayAuthenticationCertificate',
275275
'Set-AzPublicIpPrefix', 'Get-AzRouteTable', 'New-AzRouteTable',
276276
'Remove-AzRouteTable', 'Add-AzRouteConfig', 'Get-AzRouteConfig',
277277
'New-AzRouteConfig', 'Remove-AzRouteConfig', 'Set-AzRouteConfig',
278-
'Set-AzRouteTable', 'Set-AzVirtualNetworkGateway',
278+
'Set-AzRouteTable', 'New-AzRadiusServer', 'Set-AzVirtualNetworkGateway',
279279
'Get-AzVirtualNetworkGateway', 'New-AzVirtualNetworkGateway',
280280
'Get-AzVirtualNetworkGatewayVpnclientConnectionHealth',
281281
'Get-AzVpnClientRootCertificate',

‎src/Network/Network/Cortex/VpnServerConfiguration/NewAzureRmVpnServerConfigurationCommand.cs

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,19 +87,23 @@ public class NewAzureRmVpnServerConfigurationCommand : VpnServerConfigurationBas
8787
public string[] VpnClientRevokedCertificateFilesList { get; set; }
8888

8989
[Parameter(
90-
Mandatory = true,
90+
Mandatory = false,
9191
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
9292
HelpMessage = "P2S External Radius server address.")]
93-
[ValidateNotNullOrEmpty]
9493
public string RadiusServerAddress { get; set; }
9594

9695
[Parameter(
97-
Mandatory = true,
96+
Mandatory = false,
9897
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
9998
HelpMessage = "P2S External Radius server secret.")]
100-
[ValidateNotNullOrEmpty]
10199
public SecureString RadiusServerSecret { get; set; }
102100

101+
[Parameter(
102+
Mandatory = false,
103+
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
104+
HelpMessage = "P2S External multiple radius servers.")]
105+
public PSRadiusServer[] RadiusServerList { get; set; }
106+
103107
[Parameter(
104108
Mandatory = false,
105109
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
@@ -172,6 +176,7 @@ public override void Execute()
172176
this.VpnClientRevokedCertificateFilesList,
173177
this.RadiusServerAddress,
174178
this.RadiusServerSecret,
179+
this.RadiusServerList,
175180
this.RadiusServerRootCertificateFilesList,
176181
this.RadiusClientRootCertificateFilesList,
177182
this.AadTenant,

‎src/Network/Network/Cortex/VpnServerConfiguration/UpdateAzureRmVpnServerConfigurationCommand.cs

Lines changed: 32 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,6 @@ public class UpdateAzureRmVpnServerConfigurationCommand : VpnServerConfiguration
169169
Mandatory = false,
170170
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationResourceId + CortexParameterSetNames.ByRadiusAuthentication,
171171
HelpMessage = "P2S External Radius server address.")]
172-
[ValidateNotNullOrEmpty]
173172
public string RadiusServerAddress { get; set; }
174173

175174
[Parameter(
@@ -184,9 +183,22 @@ public class UpdateAzureRmVpnServerConfigurationCommand : VpnServerConfiguration
184183
Mandatory = false,
185184
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationResourceId + CortexParameterSetNames.ByRadiusAuthentication,
186185
HelpMessage = "P2S External Radius server secret.")]
187-
[ValidateNotNullOrEmpty]
188186
public SecureString RadiusServerSecret { get; set; }
189187

188+
[Parameter(
189+
Mandatory = false,
190+
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
191+
HelpMessage = "P2S External multiple radius servers.")]
192+
[Parameter(
193+
Mandatory = false,
194+
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationObject + CortexParameterSetNames.ByRadiusAuthentication,
195+
HelpMessage = "P2S External multiple radius servers.")]
196+
[Parameter(
197+
Mandatory = false,
198+
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationResourceId + CortexParameterSetNames.ByRadiusAuthentication,
199+
HelpMessage = "P2S External multiple radius servers.")]
200+
public PSRadiusServer[] RadiusServerList { get; set; }
201+
190202
[Parameter(
191203
Mandatory = false,
192204
ParameterSetName = CortexParameterSetNames.ByVpnServerConfigurationName + CortexParameterSetNames.ByRadiusAuthentication,
@@ -364,19 +376,30 @@ public override void Execute()
364376
// VpnAuthenticationType = Radius related validations.
365377
else if (vpnServerConfigurationToUpdate.VpnAuthenticationTypes.Contains(MNM.VpnAuthenticationType.Radius))
366378
{
367-
if (this.RadiusServerAddress != null)
379+
if ((this.RadiusServerList != null && this.RadiusServerList.Count() > 0) && (this.RadiusServerAddress != null || this.RadiusServerSecret != null))
368380
{
369-
vpnServerConfigurationToUpdate.RadiusServerAddress = this.RadiusServerAddress;
381+
throw new ArgumentException("Cannot configure both singular radius server and multiple radius servers at the same time.");
370382
}
371383

372-
if (this.RadiusServerSecret != null)
384+
if (RadiusServerList != null && this.RadiusServerList.Count() > 0)
373385
{
374-
vpnServerConfigurationToUpdate.RadiusServerSecret = SecureStringExtensions.ConvertToString(this.RadiusServerSecret);
386+
vpnServerConfigurationToUpdate.RadiusServers = this.RadiusServerList.ToList();
387+
vpnServerConfigurationToUpdate.RadiusServerAddress = null;
388+
vpnServerConfigurationToUpdate.RadiusServerSecret = null;
375389
}
376-
377-
if (vpnServerConfigurationToUpdate.RadiusServerAddress == null || vpnServerConfigurationToUpdate.RadiusServerSecret == null)
390+
else
378391
{
379-
throw new ArgumentException("Both radius server address and secret must be specified if VpnAuthenticationType is being configured as Radius.");
392+
if (this.RadiusServerAddress != null)
393+
{
394+
vpnServerConfigurationToUpdate.RadiusServerAddress = this.RadiusServerAddress;
395+
}
396+
397+
if (this.RadiusServerSecret != null)
398+
{
399+
vpnServerConfigurationToUpdate.RadiusServerSecret = SecureStringExtensions.ConvertToString(this.RadiusServerSecret);
400+
}
401+
402+
vpnServerConfigurationToUpdate.RadiusServers = null;
380403
}
381404

382405
// Read the RadiusServerRootCertificates if present

‎src/Network/Network/Cortex/VpnServerConfiguration/VpnServerConfigurationBaseCmdlet.cs

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@ public PSVpnServerConfiguration CreateVpnServerConfigurationObject(
104104
string[] vpnClientRevokedCertificateFilesList,
105105
string radiusServerAddress,
106106
SecureString radiusServerSecret,
107+
PSRadiusServer[] radiusServers,
107108
string[] radiusServerRootCertificateFilesList,
108109
string[] radiusClientRootCertificateFilesList,
109110
string aadTenant,
@@ -172,13 +173,17 @@ public PSVpnServerConfiguration CreateVpnServerConfigurationObject(
172173
// VpnAuthenticationType = Radius related validations.
173174
else if (vpnAuthenticationType.Contains(MNM.VpnAuthenticationType.Radius))
174175
{
175-
if (radiusServerAddress == null || radiusServerSecret == null)
176+
if (radiusServerAddress != null)
176177
{
177-
throw new ArgumentException("Both radius server address and secret must be specified if VpnAuthenticationType is being configured as Radius.");
178+
vpnServerConfiguration.RadiusServerAddress = radiusServerAddress;
178179
}
179180

180-
vpnServerConfiguration.RadiusServerAddress = radiusServerAddress;
181-
vpnServerConfiguration.RadiusServerSecret = SecureStringExtensions.ConvertToString(radiusServerSecret);
181+
if (radiusServerSecret != null)
182+
{
183+
vpnServerConfiguration.RadiusServerSecret = SecureStringExtensions.ConvertToString(radiusServerSecret);
184+
}
185+
186+
vpnServerConfiguration.RadiusServers = radiusServers?.ToList();
182187

183188
// Read the RadiusServerRootCertificates if present
184189
if (radiusServerRootCertificateFilesList != null)

‎src/Network/Network/Generated/Models/PSVpnClientConfiguration.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ public partial class PSVpnClientConfiguration
4848
public List<PSVpnClientRootCertificate> VpnClientRootCertificates { get; set; }
4949
public List<PSVpnClientRevokedCertificate> VpnClientRevokedCertificates { get; set; }
5050
public List<PSIpsecPolicy> VpnClientIpsecPolicies { get; set; }
51+
public List<PSRadiusServer> RadiusServers { get; set; }
5152

5253
[JsonIgnore]
5354
public string VpnClientProtocolsText
@@ -78,5 +79,11 @@ public string VpnClientIpsecPoliciesText
7879
{
7980
get { return JsonConvert.SerializeObject(VpnClientIpsecPolicies, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
8081
}
82+
83+
[JsonIgnore]
84+
public string RadiusServersText
85+
{
86+
get { return JsonConvert.SerializeObject(RadiusServers, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
87+
}
8188
}
8289
}

‎src/Network/Network/Models/Cortex/PSVpnServerConfiguration.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@ public class PSVpnServerConfiguration : PSTopLevelResource
4141

4242
public string RadiusServerSecret { get; set; }
4343

44+
public List<PSRadiusServer> RadiusServers { get; set; }
45+
4446
public PSAadAuthenticationParameters AadAuthenticationParameters { get; set; }
4547

4648
[Ps1Xml(Label = "P2SVpnGateway ids", Target = ViewControl.Table)]
@@ -61,6 +63,12 @@ public string VpnClientRevokedCertificatesText
6163
get { return JsonConvert.SerializeObject(VpnClientRevokedCertificates, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
6264
}
6365

66+
[JsonIgnore]
67+
public string RadiusServersText
68+
{
69+
get { return JsonConvert.SerializeObject(RadiusServers, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
70+
}
71+
6472
[JsonIgnore]
6573
public string RadiusServerRootCertificatesText
6674
{

‎src/Network/Network/Models/PSRadiusServer.cs

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.WindowsAzure.Commands.Common.Attributes;
16+
17+
namespace Microsoft.Azure.Commands.Network.Models
18+
{
19+
public class PSRadiusServer
20+
{
21+
/// <summary>
22+
/// Radius server address
23+
/// </summary>
24+
[Ps1Xml(Target = ViewControl.Table)]
25+
public string RadiusServerAddress { get; set; }
26+
27+
/// <summary>
28+
/// Radius server secret
29+
/// </summary>
30+
public string RadiusServerSecret { get; set; }
31+
32+
/// <summary>
33+
/// Radius server score
34+
/// </summary>
35+
[Ps1Xml(Target = ViewControl.Table)]
36+
public int RadiusServerScore { get; set; }
37+
}
38+
}

0 commit comments

Comments
 (0)