Tutorial: Deploy Always On VPN - Set up infrastructure for Always On VPN
In this tutorial, you'll learn how to deploy Always On VPN connections for remote domain-joined Windows client computers. You'll create a sample infrastructure that shows you how to implement an Always On VPN connection process. The process is composed of the following steps:
The Windows VPN client uses a public DNS server to perform a name resolution query for the IP address of the VPN gateway.
The VPN client uses the IP address returned by DNS to send a connection request to the VPN gateway.
The VPN server is also configured as a Remote Authentication Dial-In User Service (RADIUS) Client; the VPN RADIUS Client sends the connection request to the NPS server for connection request processing.
The NPS server processes the connection request, including performing authorization and authentication, and determines whether to allow or deny the connection request.
The NPS server forwards an Access-Accept or Access-Deny response to the VPN server.
The connection is initiated or terminated based on the response that the VPN server received from the NPS server.
Prerequisites
To complete the steps in this tutorial,
You'll need access to four physical computers or virtual machines (VMs).
Ensure that your user account on all machines is a member of Administrators, or equivalent.
Important
Using Remote Access in Microsoft Azure is not supported, including both Remote Access VPN and DirectAccess. For more information, see Microsoft server software support for Microsoft Azure virtual machines.
Create the domain controller
Install Windows Server on the machine that will run the domain controller.
Install Active Directory Domain Services (AD DS). For detailed information on how to install AD DS, see Install Active Directory Domain Services.
Promote the Windows Server to domain controller. For this tutorial, you'll create a new forest and the domain to that new forest. For detailed information on how to install the domain controller, see AD DS Installation.
Install and configure the Certificate Authority (CA) on the domain controller. For detailed information on how to install CA, see Install the Certification Authority.
Create an Active Directory Group Policy
In this section, you'll create a Group Policy on the domain controller so that domain members automatically request user and computer certificates. This configuration lets VPN users request and retrieve user certificates that automatically authenticate VPN connections. This policy also allows the NPS server to request server authentication certificates automatically.
On the domain controller, open Group Policy Management.
In the left pane, right-click your domain (for example, corp.contoso.com). Select Create a GPO in this domain, and Link it here.
On the New GPO dialog box, for Name, enter Autoenrollment Policy. Select OK.
In the left pane, right-click Autoenrollment Policy. Select Edit to open the Group Policy Management Editor.
In the Group Policy Management Editor, complete the following steps to configure computer certificate autoenrollment:
In the left pane, go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.
In the details pane, right-click Certificate Services Client – Auto-Enrollment. Select Properties.
On the Certificate Services Client – Auto-Enrollment Properties dialog box, for Configuration Model, select Enabled.
Select Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificate templates.
Select OK.
In the Group Policy Management Editor, complete the following steps to Configure user certificate autoenrollment:
In the left pane, go to User Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.
In the details pane, right-click Certificate Services Client – Auto-Enrollment and select Properties.
On the Certificate Services Client – Auto-Enrollment Properties dialog box, in Configuration Model, select Enabled.
Select Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificate templates.
Select OK.
Close the Group Policy Management Editor.
Close Group Policy Management.
Create the NPS server
Install Windows Server on the machine that will run the NPS server.
On the NPS server, install the Network Policy and Access Services (NPS) role. For detailed information on how to install NSP, see Install Network Policy Server.
Register the NPS Server in Active Directory. For information on how to register NPS Server in Active Directory, see Register an NPS in an Active Directory Domain.
Make sure that your firewalls allow the traffic that is necessary for both VPN and RADIUS communications to function correctly. For more information, see Configure Firewalls for RADIUS Traffic.
Create the NPS Servers group:
On the domain controller, open Active Directory Users and Computers.
Under your domain, right-click Computers. Select New, then select Group.
In Group name, enter NPS Servers, then select OK.
Right-click NPS Servers and select Properties.
On the Members tab of the NPS Servers Properties dialog box, select Add.
select Object Types, select the Computers check box, then select OK.
In Enter the object names to select, enter the computer name of the NPS server. Select OK.
Close Active Directory Users and Computers.
Create the VPN server
Install Windows Server on the machine that will run the VPN Server. Ensure that the machine has two physical network adapters installed: one to connect to the internet, and one to connect to the network where the domain controller is located.
Identify which network adapter connects to the internet and which network adapter connects to the domain. Configure the network adapter facing the internet with a public IP address, while the adapter facing the intranet can use an IP address from the local network.
For the network adapter connecting to the domain, set the DNS preferred IP address to the IP address of the domain controller.
Join the VPN server to the domain. For information on how to join a server to a domain, see To join a server to a domain.
Open your firewall rules to allow UDP ports 500 and 4500 inbound to the external IP address applied to the public interface on the VPN server.
On the network adapter connecting to the domain, enable the following ports: UDP1812, UDP1813, UDP1645, and UDP1646.
Create the VPN Servers group:
On the domain controller, open Active Directory Users and Computers.
Under your domain, right-click Computers. Select New, then select Group.
In Group name, enter VPN Servers, then select OK.
Right-click VPN Servers and select Properties.
On the Members tab of the VPN Servers Properties dialog box, select Add.
select Object Types, select the Computers check box, then select OK.
In Enter the object names to select, enter the computer name of the VPN server. Select OK.
Close Active Directory Users and Computers.
Follow the steps in Install Remote Access as a VPN server to install the VPN server.
Open the Routing and Remote Access tool from Server Manager.
Right-click the VPN server, and then select Properties.
In Properties, select the Security tab and then:
Select Authentication provider and select RADIUS Authentication.
Select Configure to open the RADIUS Authentication dialog.
Select Add to open the Add RADIUS Server dialog.
In Server name, enter the Fully Qualified Domain Name (FQDN) of the NPS server. In this tutorial, the NPS server is the domain controller server. For example, if the NetBIOS name of your NPS and domain controller server is dc1 and your domain name is corp.contoso.com, enter dc1.corp.contoso.com.
In Shared secret, select Change to open the Change Secret dialog box.
In New secret, enter a text string.
In Confirm new secret, enter the same text string, then select OK.
Save this secret. You'll need it when you add this VPN server as a RADIUS client later in this tutorial.
Select OK to close the Add RADIUS Server dialog.
Select OK to close the Radius Authentication dialog.
On the VPN server Properties dialog, select Authentication Methods....
Select Allow machine certificate authentication for IKEv2.
Select OK.
For Accounting provider, select Windows Accounting.
Select OK to close the Properties dialog.
A dialog will prompt you to restart the server. Select Yes.
Create VPN Windows client
Install Windows 10 or later on the machine that will be your VPN client.
Join the VPN client to your domain. For information on how to join a computer to a domain, see To join a computer to a domain.
Create VPN User and Group
Create a VPN User by taking the following steps:
On the domain controller, open Active Directory Users and Computers.
Under your domain, right-click Users. Select New. For User logon name, enter any logon name. Select Next.
Choose a password for the user.
Deselect User must change password at next logon. Select Password never expires.
Select Finish. Keep Active Directory Users and Computers open.
Create a VPN User group by taking the following steps:
Under your domain, right-click Users. Select New, then select Group.
In Group name, enter VPN Users, then select OK.
Right-click VPN Users and select Properties.
On the Members tab of the VPN Users Properties dialog box, select Add.
On the Select Users dialog box, add the VPN user that you created and select OK.
Configure VPN server as a RADIUS client
On the NPS server, open your firewall rules to allow UDP ports 1812, 1813, 1645, and 1646 inbound.
In the NPS console, double-click RADIUS Clients and Servers.
Right-click RADIUS Clients and select New to open the New RADIUS Client dialog box.
Verify that the Enable this RADIUS client check box is selected.
In Friendly name, enter a display name for the VPN server.
In Address (IP or DNS), enter the IP address or FQDN of the VPN server.
If you enter the FQDN, select Verify if you want to verify that the name is correct and maps to a valid IP address.
In Shared secret:
Ensure that Manual is selected.
Enter the secret that you created in the Create the VPN server section.
For Confirm shared secret, re-enter the shared secret.
Select OK. The VPN Server should appear in the list of RADIUS clients configured on the NPS server.
Configure NPS server as a RADIUS server
Note
In this tutorial, the NPS server is installed on the domain controller with the CA role; and we don't need to register a separate NPS server certificate. However, in an environment where the NPS server is installed on a separate server, an NPS server certificate must be enrolled before you can preform these steps.
In the NPS console, select NPS(Local).
In Standard Configuration, ensure that RADIUS server for Dial-Up or VPN Connections is selected.
Select Configure VPN or Dial-Up to open the Configure VPN or Dial-Up wizard.
Select Virtual Private Network (VPN) Connections, and select Next.
In Specify Dial-Up or VPN Server, in RADIUS clients, select the name of the VPN server.
Select Next.
In Configure Authentication Methods, complete the following steps:
Clear Microsoft Encrypted Authentication version 2 (MS-CHAPv2) .
Select Extensible Authentication Protocol.
For Type, select Microsoft: Protected EAP (PEAP). Then select Configure to open the Edit Protected EAP Properties dialog box.
Select Remove to remove the Secured Password (EAP-MSCHAP v2) EAP type.
Select Add. The Add EAP dialog box opens.
Select Smart Card or other certificate, then select OK.
Select OK to close Edit Protected EAP Properties.
Select Next.
In Specify User Groups, complete the following steps:
Select Add. The Select Users, Computers, Service Accounts, or Groups dialog box opens.
Enter VPN Users, then select OK.
Select Next.
On Specify IP Filters, select Next.
On Specify Encryption Settings, select Next. Do not make any changes.
On Specify a Realm Name, select Next.
Select Finish to close the wizard.
Next steps
Now you've created your sample infrastructure you are ready to being configuring your Certificate Authority.