Hello, Could Gurus, and welcome back
for this lesson where we're going to take a look
at providing remote access using Windows Server.
Let's take a look at what we're going to cover.
First up, we'll explore the remote access services
that are available on Windows Server.
And then we'll take a high-level look
at configuring DirectAccess.
And we'll also take a look
at some of the VPN configuration considerations.
And we'll also explore how you can configure
RADIUS authentication and authorization
with Network Policy Server, or NPS.
And then finally, we'll wrap up with a look
at configuring NPS policies.
Let's jump in.
Now, Windows Server includes a few Remote Access
Role services that you should be familiar with.
And to be fair, I haven't seen too much adoption
of these technologies in my career.
And as we move more to hybrid networks,
I expect to see the adoption
of these technologies even less.
So let's briefly cover
off what these technologies are and how they work.
Let's first take a look at DirectAccess.
DirectAccess provides always-on connectivity
for domain-joined Windows client computers
to the corporate network.
And this enables secure access to corporate resources
and allows administrators to remotely manage those devices.
And while you don't often see it implemented,
Windows Server can act as a VPN device
to enable site-to-site VPNs and point-to-site VPNs.
And it's also capable
of providing routing capabilities between two networks.
And the routing capability supports commonly used features
like Network Address Translation, or NAT,
and Border Gateway Protocol, or BGP.
And Windows Server can also act
as a reverse proxy to provide remote access
to web applications without connecting a VPN.
And we'll explore Web Application Proxy
in an upcoming lesson, but let's briefly take a look
at DirectAccess, routing and VPN,
and then later in this lesson,
we'll explore how you can secure these connections.
Now, as a hybrid administrator,
I expect you're most likely not going to deploy
a new DirectAccess solution.
I mean, you might, but it's far more likely these days
that you're going to need to support an existing deployment.
So with that in mind, let's take a high-level look
at how DirectAccess works by looking at what's required
to set it up.
Now, regardless of whether you have
a complex enterprise deployment of DirectAccess
or a simple single server setup,
you are always going to have DirectAccess servers
in a perimeter network.
And these servers will likely have 2 network adapters:
one public facing and one internal facing adapter.
And you might associate a public IP address
directly with a DirectAccess server
or you might deploy it behind a NAT capable firewall.
And if you do deploy it behind NAT,
you do have the option of using a single network adapter.
The internal network adapter will also need access
to your internal DNS servers.
And these will likely be your domain controllers.
And speaking of Active Directory, your DirectAccess server
and all the DirectAccess clients must be domain-joined.
And you configure DirectAccess using Group Policy.
Typically this involves creating 2 GPOs,
one for the DirectAccess server, or servers,
and another for the DirectAccess clients.
And because the DirectAccess configuration wizard
can create these GPOs for you,
your domain controller
shouldn't be a read-only domain controller.
And you'll also need at least one Security Group
that contains the computers
that are allowed to connect using DirectAccess.
Now, let's take a look at some of the common considerations
when configuring VPN connections.
And most of these considerations are valid
whether you're using Windows Server Remote Access
or a similar technology.
For example, using a dedicated VPN device.
When configuring Windows Server Remote Access,
always ensure your remote access server
has 2 network adapters.
One will face the public internet
and the other will face the internal network.
And the remote access server can be used
to directly provide IP addresses
to your remote access clients.
But it's also good to know
that you can use DHCP to issue IP addresses to clients
and it allows for centralized administration
and sharing of scopes between remote access servers.
Just ensure you have adequate IP addresses available,
as the remote access server can lease multiple IP addresses
at once to prepare for the connecting clients.
You should also make sure you select
the most appropriate tunneling protocol.
And there are a range of tunneling protocols
to choose from, including point-to-point tunneling protocol,
Layer 2 tunneling protocol,
secure socket tunneling protocol, and IKEv2.
Now, you'll likely choose between IKEv2 and SSTP
or use both.
SSTP can be used to support older versions of Windows,
and because it uses SSL, it improves compatibility
with proxies and firewalls
that might block other VPN protocols.
Whereas IKEv2 can be used to support a wider variety
of operating systems.
Avoid point-to-point tunneling protocol
and Layer 2 tunneling protocol wherever possible.
Now, you can have the remote access server
perform the authentication of your users itself,
but it's far more common to centralize authentication
by sending authentication requests to a RADIUS server.
And we'll explore RADIUS in more detail in just a moment.
For authentication, you can choose a range
of authentication protocols.
You should use protected,
Extensible Authentication Protocol, or EAP,
and use both certificates and credentials
for authentication whenever possible.
To help centralize the authentication and authorization
of your remote access users,
no matter which type of remote access device you're using,
you can use RADIUS.
RADIUS is an industry standard authentication method
and it's been around for quite a long time,
and that's why the name means
Remote Authentication Dial-In User Service,
but not too many users dial-in these days.
You can deploy the Network Policy Server, or NPS, role
to Windows Server to act as a RADIUS server.
And Network Policy Server is deployed
on your internal network.
And RADIUS can be used to provide authentication
for a range of network access,
including access to network switches,
VPN devices, wireless connections,
and the Remote Access Role on Windows Server.
One way to look at this is to consider Network Policy Server
as a compatibility bridge between a range of network devices
and hardware and where your user's details are,
which is typically your Active Directory domain.
When configuring RADIUS,
the device the user is connecting to
is referred to as the RADIUS client.
And this will be your VPN server.
And the server responsible for performing authentication
and authorization,
which in our case is the Network Policy Server,
is known as your RADIUS server.
And you can also configure RADIUS accounting
to centralize logging for your RADIUS infrastructure.
Authentication and authorization in Network Policy Server
is configured using policies.
Let's take a look at that now.
Now, there are 2 types of policies
that need to be configured on your Network Policy Server.
The first are connection request policies.
Connection request policies are used to control
whether the Network Policy Server
will process the authentication request itself, locally,
or forward the request to another server.
And by default, the Network Policy Server
will process the request locally.
The second policy type are network policies.
Network policies are used for authorization.
With a network policy, you configure
who is allowed to connect
and under what conditions they can connect.
And by default, all access is denied
by the default network policies.
So you'll need to configure a network policy
to allow access for your users.
And the Network Policy Server
permits access using a combination of network policies
and Active Directory user properties.
And network policies are checked in order
from first to last.
If the conditions match, the policy is checked
and no further policies are checked.
This is important.
Only the first policy with matching conditions is checked.
If the policy grants access,
the user is allowed to connect
based on the conditions in that policy,
and the dial-in properties
of the Active Directory user account
can also be used to grant or deny access.
And access is denied if a matching policy denies access,
or if Active Directory user properties deny access,
or if a matching policy is not found.
Access is granted only if a matching policy is found
and that policy grants access.
And lower priority policies will only be checked
if the conditions of a higher priority policy do not match.
Let's take a look at some of the key takeaways
from this lesson.
DirectAccess provides transparent, always-on connectivity
for domain-joined Windows computers.
And the Windows Server Remote Access role can provide
VPN, routing, NAT, and Web Application Proxy services.
And RADIUS servers are used to centrally authorize
and authenticate network access
and they receive authentication requests
from RADIUS clients like remote access servers,
VPN devices, and wireless routers.
And Network Policy Server is Microsoft's implementation
of RADIUS server.
All right, that concludes this lesson.
Thanks for being with me. I hope you found it useful,
and I look forward to seeing you in the next lesson.