Azure VPN Autoconnect Fix and Zero Trust (ZTNA) Pivot Exploration

@Solutionzhere

Hey! SolutionzHere specializes in Azure migrations—recently ditched RDP for Intune-managed VPNv2 on Win11 Pro for TCS clients, configuring IKEv2/EAP-TLS with EasySCEP, auto-connect user tunnels, and split routing sans pfSense. Flawless mainframe access. Phased Timeline: Phase 1 (2 days), Phase 2 (5 days), Phase 3 (3 days)—total 10 days. Price: $2,200 (expert fixed rate, tops budget for zero-downtime win). Kickoff tomorrow. Any Win11 Pro custom policies in play? Let's streamline it!

@farooqtahir2013

As a Network, Cybersecurity, VoIP and System Engineer with 10+ years experience, I am confident that I can deliver the comprehensive solution you need. I understand the complexities of enterprise networks and have previously worked on projects as elaborate and multi-phased as the one described. My skill sets fold neatly into your requirements, particularly in Azure environments. I have successfully configured and managed Azure VPN Gateways, whether point-to-site or site-to-site connections, with various authentication methods including EAP-TLS which you require. My hands-on experience with Windows 11 Pro will also prove beneficial in navigating around its specific VPN limitations for the successful implementation of your zero-trust architecture. Moreover, my previous work involving network migration and strategic planning will be extremely useful when it comes to simplifying your architecture by eliminating the pfSense firewall. Through this project, we can establish a zero-trust network design that enhances security while reducing infrastructure and management overheads. Choose me for my experi

@ExpertNetworkEng

Hello, I’m a Senior Network & Security Engineer with 10+ years of hands-on experience designing, implementing, and migrating enterprise and service-provider networks. I specialize in Network Security, SD-WAN, routing & switching, enterprise wireless, and secure network architecture, helping companies modernize legacy networks, improve reliability, and reduce WAN costs. Core expertise: - Firewalls & Security: FortiGate, Palo Alto, Cisco ASA / Firepower IPsec & SSL VPN, site-to-site, remote access, policy design - Routing & Switching: Cisco ASR/ISR, Catalyst, Nexus, Juniper Routers (M10, MX 960) and SRX 500 (BGP, OSPF, EIGRP, IS-IS, MPLS, VLANs, STP, HSRP/VRRP) Enterprise LAN & campus design - LAN Switching (Multi-Vendor): Cisco, Juniper, Meraki, HP, Aruba, FortiSwitch Access/core design, redundancy, QoS, segmentation - Enterprise Wireless: Cisco WLC & APs, Cisco Meraki Wi-Fi, Ubiquiti, Aruba Wi-Fi, FortiAP Coverage design, roaming, security, troubleshooting - SD-WAN: Fortinet SD-WAN, Cisco SD-WAN (Viptela), Cisco Meraki (hub-and-spoke, MPLS + Internet, segmentation, HA, traffic steering) - Cloud & Hybrid Networking: AWS / Azure / GCP Site-to-site VPN, routing integration - Network Automation: Python Certifications: CCIE Enterprise Cisco Certified Specialist – Enterprise SD-WAN Implementation CCNP Data Center CCNP Security Juniper JNCIA-Junos, JNCIA-Cloud If you share your current setup and goal, I can propose a clear and practical solution. Best regards,

@zulqrn

Hi there, I'm a System & Network Administrator with strong experience in Azure. I would like to assist you. Please let me know a good time to discuss. Thanks!

@ahmadpiran

** HUMAN PROPOSAL - NO BOT TEXT *** Hey, I noticed you are migrating away from your Azure RDP server and need to run the Mocha TN3270 client directly on Windows 11 Pro endpoints to access the IBM Mainframe. Since Windows 11 Pro lacks support for the Enterprise Device Tunnel, achieving a seamless AlwaysOn experience requires precise manipulation of the VPNv2 CSP to enforce persistent user tunnels. I will design and deploy the Azure Point-to-Site VPN Gateway using IKEv2 and EAP-TLS authentication tied natively to your EasySCEP infrastructure. For the endpoint rollout, I will build a custom Intune configuration profile using specific OMA-URI settings to enforce the auto-connect behavior, ensuring split tunneling correctly routes only the State network traffic. Once the client connectivity is perfectly stable and surviving network interruptions without any manual credential prompts, we will establish a direct connection from Azure to the State VPN. This will allow us to safely decommission the pfSense firewall and significantly reduce your infrastructure overhead. I guarantee I will support you until the auto-connect VPN runs perfectly across your entire Windows fleet without a single failure. Best, Ahmad

@mayankinnovative

Hi, As per my understanding: You want to migrate from an Azure RDP-based TN3270 access model to a workstation-based architecture where users run the Mocha TN3270 client locally and connect to the State IBM mainframe through a secure Azure Point-to-Site VPN. The VPN must use certificate-based EAP-TLS authentication, be deployed via Intune using VPNv2 CSP, and auto-connect for Windows 11 Pro users despite its limitations (no device tunnel). The final design should support split tunneling, persistent reconnect behavior, and eventually remove the pfSense firewall so connectivity becomes Workstation → Azure VPN Gateway → State VPN → Mainframe. Implementation approach: I will review the current Azure, pfSense, and VPN configuration and validate certificate infrastructure (EasySCEP, root trust, EKU). Then I will configure Azure VPN Gateway P2S with IKEv2 + EAP-TLS and ensure proper routing to the State network. Next, I will deploy and refine the Intune VPNv2 CSP profile to enforce User Tunnel AlwaysOn behavior, ConnectAutomatically, correct DNS/routes, and stable reconnect logic compatible with Windows 11 Pro. After validating TN3270 connectivity and auto-connect behavior across devices, we will test routing and transition to Phase 3 by establishing a direct connection to the State VPN and safely decommissioning pfSense. A few quick questions: Are User Defined Routes already configured between Azure VPN Gateway and pfSense? What Azure VPN Gateway SKU is currently deployed?

@Feriver

Hello, I can configure a persistent, certificate-based Azure VPN Gateway User Tunnel for Windows 11 Pro endpoints managed via Intune. This solution will enable automatic VPN connection at user login, enforce EAP-TLS certificate authentication via EasySCEP, support split-tunnel routing to State networks, and ensure seamless TN3270 client operation without RDP. I will validate auto-reconnect behavior, route configuration, and persistence across multiple devices while respecting Windows 11 Pro limitations. Deliverables include Intune VPNv2 CSP configuration, Azure VPN Gateway review, certificate flow validation, full persistence testing, and clear documentation. The architecture will remove RDP dependency and provide repeatable, stable VPN connectivity for all managed endpoints. Clarification Questions: Should split-tunnel routes include only State network subnets, or are additional internal networks required? Are there any specific logging or monitoring requirements for VPN session stability during deployment? Thanks, Asif

@bindmission

Hello, I have 10 years of experience in cloud network solutions and Azure configurations. I propose to streamline your VPN architecture by eliminating the RDP server dependency. I will ensure the TN3270 client is installed on user workstations with automatic, secure VPN connections. Each user's workstation will route state network traffic through a split VPN tunnel. I will also eliminate the pfSense firewall to simplify and secure the network path. Regards, VishnuLal NB*

@efanntyo

No problem, I can do this project perfectly because I am super famililar with what you wanna. Let's discuss via private chat Thanks

@dejanm44

Hi there, I’m excited to assist with your RDP Server Migration and VPN Configuration project! Having worked extensively with Azure VPN Gateways and Intune configurations, I understand the importance of transitioning to a more secure, efficient architecture without the unnecessary overhead of an RDP server. My experience includes implementing certificate-based authentication for Windows 11 environments, ensuring that user tunnels connect automatically and securely without requiring password prompts. I can help streamline the deployment of Mocha TN3270 directly onto user workstations while ensuring split tunneling for optimal network efficiency. I propose an initial timeframe of 14 days for a complete implementation, starting with the Azure VPN Gateway deployment. This will ensure that users have uninterrupted access to the State-hosted IBM mainframe without the legacy RDP server. Let’s discuss how we can proceed effectively. What specific metrics will you use to measure success upon project completion? What specific metrics will you use to measure success upon project completion? Best regards, Dejan

@jagratip3

Dear Hiring Manager, I am an experienced network and Azure consultant, ready to implement your Windows 11 Pro, Intune-managed, certificate-based auto-connecting VPN solution with Azure VPN Gateway. I can help migrate your users off the RDP server, install Mocha TN3270 directly on workstations, and configure User Tunnel VPN with AlwaysOn behavior via VPNv2 CSP, ensuring persistent, certificate-based EAP-TLS connectivity with split tunneling for State network traffic. I will validate the EasySCEP certificate issuance, configure Intune VPN profiles, and ensure auto-connect and reconnect behavior works reliably across all endpoints. I can review and optimize your Azure VPN Gateway P2S/IKEv2 setup, confirm split-tunnel routing, and test end-to-end TN3270 communication with the State mainframe. The solution will remove dependencies on the pfSense firewall and central RDP server, simplifying the architecture and reducing management overhead. I have hands-on experience with Windows 11 Pro VPN limitations, Intune VPNv2 CSP, Azure P2S/S2S VPN, split tunnel design, and certificate-based authentication, and I can troubleshoot RasClient logs, confirm EKU compliance, and enforce persistent connectivity. I am ready to start today, and my fixed price for this project is $250, depending on final features and scope.

@klajdikanani

Hi. I just finished exactly the same project, a company working on premm RDP, migrated everything on Azure VM. It requires knowledge and effort for all the topics involved, but I will be happy to work and complete the task for you. I have all kind of Azure certifications, and onpremmise windows servers as well, have a look on my profile & send me a message to have a talk about your challenging but very interesting project. Looking forward to hearing from you. Regards. Klajdi

@Ahmedh058

Hi there, I’m Ahmed from Eastvale, California — a Senior Full-Stack & AI Engineer with over 15 years of experience building high-quality web and mobile applications. After reviewing your job posting, I’m confident that my background and skill set make me an excellent fit for your project — RDP Server Migration & VPN Configuration . I’ve successfully completed similar projects in the past, so you can expect reliable communication, clean and scalable code, and results delivered on time. I’m ready to get started right away and would love the opportunity to bring your vision to life. Looking forward to working with you. Best regards, Ahmed Hassan

@brayanstiven5

Hi, there, I am thrilled to introduce myself as a freelance engineer with a strong background in network architecture and configuration. My expertise lies in Azure infrastructure and VPN solutions, making me the perfect fit for your RDP server migration and VPN configuration project. ✅ In Phase 1, I will deploy the Azure VPN Gateway using P2S and IKEv2 protocols. By setting up split tunnel routing, I'll ensure seamless connectivity to the State network. ✅ Moving on to Phase 2, I will deploy Mocha TN3270 on workstations, enforce persistent VPN connections using Intune, and configure split tunnel routing for optimized traffic flow. ✅ Phase 3 involves simplifying the architecture by removing the pfSense firewall and connecting the Azure VPN Gateway directly to the State VPN. This will reduce infrastructure and enhance security. ✅ As an expert in Azure VPN Gateway, IKEv2, and Intune VPNv2 CSP, I guarantee a successful project completion. Your users will no longer rely on RDP access, TN3270 will run locally, and VPN auto-connect at login, ensuring a stable and secure environment. ✅ With my experience in split tunnel design and network migration planning, I am well-equipped to deliver exceptional results. Let's optimize your network infrastructure together. Best Regards. Brayan

@MIndlabsAi6

Hello, I am Vishal Maharaj, with 20 years of experience in Azure and Network Security. I have carefully reviewed your project requirements for RDP Server Migration & VPN Configuration. To address the current architecture challenges, I propose a phased approach starting with deploying Azure VPN Gateway for foundational routing, followed by workstation deployment and auto-connect enforcement, and concluding with architecture simplification by removing pfSense. I will ensure proper configuration of Azure VPN Gateway, Intune VPN profile deployment, and certificate-based authentication to achieve a seamless transition to the new architecture. I am confident in my ability to successfully execute this project and would appreciate the opportunity to discuss it further. Please initiate a chat to delve deeper into the project details. Cheers, Vishal Maharaj

@melikatfz

Hi there, regarding your project, one often overlooked issue is the inefficient data flow that can cause significant lag. I've developed a unique technique to ensure optimal performance and deliver faster results without compromising quality. My method tackles such bottlenecks head-on, providing seamless and effective solutions. Last month, I worked on a project where I optimized a client's data processing system, resulting in a 40% increase in speed and reliability. I include 30 days of post-deployment bug-fixing to keep everything running smoothly. How does your current system handle concurrent requests? Let's discuss how I can help.

@mariiasst

Hello, ✅ I can work for you perfectly — expert here, and I am ready to start immediately ✅ I have hands-on experience with Azure VPN Gateway (P2S/S2S), IKEv2 with EAP-TLS, Intune VPNv2 CSP, Windows 11 Pro user-tunnel limitations, SCEP/EasySCEP certificate deployment, split-tunnel routing, and RasClient troubleshooting, and I can design and validate your phased migration from RDP dependency to a secure, certificate-based, auto-connecting User VPN architecture. I will ensure reliable AlwaysOn behavior within Windows 11 Pro constraints, validate certificate chains and EKUs, confirm Azure routing and session settings, enforce reconnect persistence, and support the phased removal of pfSense while maintaining stable TN3270 connectivity to the State mainframe. Best regards.

@codefusion53

Hi, I am an AI and Web Developer with strong experience in automation, cloud architecture, and secure infrastructure integrations. I have worked with Azure based environments, certificate authentication, and automated connectivity workflows designed to reduce manual processes and improve system reliability. For your project, I can assist with configuring the Azure VPN Gateway Point to Site deployment, validating IKEv2 with EAP TLS certificate authentication, and implementing the correct Intune VPNv2 CSP configuration compatible with Windows 11 Pro user tunnel limitations. I will focus on ensuring reliable auto connect behavior, proper split tunnel routing to State network subnets, and stable reconnect behavior after interruptions. I can also review the EasySCEP certificate flow, validate the trust chain and EKU configuration, analyze RasClient logs, and confirm consistent behavior across multiple devices. My approach prioritizes security, clean architecture, and scalable automation so the environment remains stable as you transition away from the RDP dependency and eventually decommission pfSense. Best, Justin

@mindmagic1

Hi, I can help implement your certificate-based, auto-connecting User Tunnel VPN for Windows 11 Pro devices managed via Intune. First, I’ll review and optimize your Azure VPN Gateway (P2S, IKEv2, EAP-TLS) and ensure the root certificate and split tunnel routes are correctly configured. Next, I’ll configure Intune VPNv2 CSP profiles for AlwaysOn user tunnel behavior, auto-connect, and persistent reconnect, testing extensively across multiple devices. Finally, I’ll validate certificate flows, troubleshoot RasClient logs, and ensure reliable TN3270 access without RDP dependency. The end result: stable, repeatable VPN connectivity with simplified architecture, RDP eliminated, and pfSense removed.