I use 10.238.0.0/24 at home, so I worked the subnets around that: 10.224.0.0/13 10.232.0.0/14 10.236.0.0/15 10.238.1.0/24 10.238.2.0/23   I've given it time, connected twice, have "Allow local LAN" access enabled in the client, yet a route still gets added with higher priority pointing my subnet to the Anyconnect.   10.238.0.0 255.255.255.0 On-link 10.238.0.126 306 10.238.0.0 255.255.255.0 On-link 10.238.3.103 2 10.238.0.1 255.255.255.255 On-link 10.238.0.126 51   I could forcibly create a route with a higher priority, but wondering why its doing this at all. Am I missing something? ... View more

Route based is the Default in Azure Just click on your Dashboard and search for "Virtual Network Gateways"  click ADD Choose your subscription, name the gateway, make sure you choose correct region and put the gateway in same resource group as your Vnet (keep it easy).  SKU can be standard or VpnGw1 << is better than you can modify later. under Virtual Network choose the Vnet you want to put the VPN on. Create new public IP and wait for like 20 minutes it takes a bit. you will have to create a Root Certificate and User Certificates for IKE SSTP this one is tricky to manage if you want a cert for each user.  There are guides out there but its not difficult to setup. I configured mine for Radius Authentication. FYI policy based is the IKE_v1 we dont want that !!!   ... View more

If you are using PPPoE no.  If you are using provider based DHCP, no.  If you are using a CPE doing DHCP, yes.  If you are using a provider fibre circuit and have a block oi IP addresses (such as a /29) using native Ethernet encapsulation, yes.   So the answer is - it depends. ... View more