Which server does an MS AOVPN client contact first for connection, the VPN or the NPS(radius)

James Gledson 160 Reputation points
2024-04-22T14:40:20.1866667+00:00

I am a bit confused about the order in whih the VPN and the NPS servers work together.

A client machine managed in Intune is set up with a VPN profile (user tunnel) to connect to Azure/Entra Conditonal access CA, It then downloads the 1 hour certificate if it meets the conditon.

Does the client then contact the on premise VPN server first and then the VPN server contacts the NPS/Radius server to verify the authentication(1 hour cert) or the does it contact NPS server which then contacts the VPN to set up the the connection?

Thanks

Windows Network
Windows Network
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Network: A group of devices that communicate either wirelessly or via a physical connection.
653 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,365 questions
0 comments
Accepted answer
  1. Jing Zhou 2,240 Reputation points Microsoft Vendor
    2024-04-23T09:54:38.8633333+00:00

    Hello,

    Thank you for posting in Q&A forum.

    In the situation you described, the general order is as follows:

    Firstly, the client computer will attempt to establish a connection with the local VPN server.

    Once the client computer contacts the local VPN server, the VPN server will verify the client's identity. In the case you provide, the VPN server may verify the certificate used by the client to ensure it has a valid 1-hour certificate.

    After verifying the client's identity, the VPN server will contact the NPS or radius server to further verify the client's identity and authorization. The VPN server passes the client's identity information to the NPS server and decides whether to allow the client to establish a connection based on the NPS configured policy.

    After receiving a request from the VPN server, the NPS server will verify and authorize it. It may check the validity of client certificates and decide whether to allow connections based on configured policies. If the client certificate is valid and meets the conditions, NPS will send an authorization response to the VPN server, allowing the connection to be established.

    Once the VPN server receives an authorization response from NPS, it will allow the client computer to establish a connection with the VPN server. In this way, client computers can communicate with the target network through VPN.

    Hope this answer can help you well.

    Best regards，

    Jill Zhou

    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest