Hello, Cloud Gurus,
and welcome back for this hands-on demo lesson
where we're going to take a look
at implementing Network Policy Server.
So, we have just one topic to cover in this lesson,
and that's a hands-on demo
of implementing RADIUS with Network Policy Server.
Let's get started.
In this demo, we have a remote access server
deployed in the perimeter network,
and we will examine the configuration of that server
and its configuration as a RADIUS client.
And then, we'll configure the Network Policy Server,
including its configuration as a RADIUS server.
And then, we'll explore the connection request policies
and we'll create a network policy
to allow our VPN clients to connect.
And finally, we'll test our VPN access using a client
and verify their connection.
Let's take a look.
All right, so here we are on our routing
and remote access server in the perimeter network.
Let's go ahead and take a look at the routing
and remote access configuration.
We'll launch administrative tools
and then we'll launch the Routing
and Remote Access Management Console.
And then, we'll navigate to the properties
of our Routing and Remote Access Server,
and now let's quickly take a look
at the IPv4 configuration,
and you can see here that I have this server
configured to use a static address pool,
but if I had multiple Routing and Remote Access Servers,
I could configure this server to use DHCP to centralize
that IP address administration.
Now, let's take a look at the security configuration
for this server, and you can see here that this server
is configured to use RADIUS authentication.
Let's go ahead and click Configure,
and you can see that this Routing
and Remote Access Server is configured to be a RADIUS client
and it is forwarding its authentication requests
to a RADIS server, which has the IP address of 10.1.1.6,
and that is our internal Network Policy Server.
We'll go ahead and click OK.
Now, let's go ahead and jump across
to our Network Policy Server
and configure it to be a RADIUS server
and accept authentication requests from this RADIUS client.
All right, so here we are on our Network Policy Server
on our internal network.
Let's go ahead and launch the Network Policy Server
management console.
Now, let's go ahead and configure our RADIUS client.
So, we'll expand the RADIUS Clients and Servers node.
We'll navigate to RADIUS clients,
and then we'll right-click and select New.
We'll type in a friendly name for our RADIUS server.
I'll just use the name, DMZ BNE,
RRA01,
and I'll type in the IP address
for our routing and remote access server.
And then, we'll go ahead and use a manual shared secret,
and I've configured the routing and remote access server
to also use this shared secret
when connecting to this RADIUS server.
And then, we can go ahead and click OK,
and now our RADIUS client is configured
to use this RADIUS server
and the RADIUS server is configured
to accept that client as a RADIUS client.
Then, let's go ahead and configure our policies,
and as we spoke about in the lesson,
the connection request policy is already configured
to use Windows authentication for all the users
and process that request locally,
instead of forwarding it to another server.
So, all we need to do is go ahead
and configure our network policy.
So, I'll navigate to the network policies node,
and then, I'll right-click and select New.
We'll provide a policy name.
I'm just going to use the name, VPN policy,
and the type of network access server,
I'm going to use VPN or dial up. Go ahead and click Next.
And I'm going to add a condition to allow all
domain users to use this network policy.
So, we'll go ahead and select Windows groups.
We'll click Add Groups.
We'll select Domain Users.
We'll go ahead and click OK,
and then OK again.
So, this condition will match all domain users,
which means this policy will be processed by all users
in our domain who try to connect using our Routing
and Remote Access Server.
We'll go ahead and click Next.
We're going to go ahead and grant access,
but just be aware that you could use the dial in properties
of the Active Directory users to grant access.
I'll go ahead and click Next.
Now, we're going to use EAP, or Extensible Authentication
Protocol to authenticate our users.
I'm going to go ahead and click Add.
Now, to allow our users to authenticate using a password,
I'm going to go ahead and select EAP MSCHAP v2.
We'll go ahead and click OK,
and because MSCHAT v1 is considered not secure,
we're going to go ahead and remove that authentication
method, and then, we'll go ahead and click Next.
Now, we don't need to configure any additional options.
So, I'm just going to go ahead
and select Next, Next, and then Finish.
All right, our network policy is now configured.
Now, let's go ahead and test our VPN connectivity.
All right, so here we are on our VPN client.
Let's go ahead and configure our VPN connection.
I'll just click the Network icon in the system tray.
we'll go ahead and select Network and Internet Settings.
Then we'll select VPN.
Click to Add a VPN Connection.
I'll select the Windows built-in VPN provider.
I'll provide a connection name of CORP
and for the server name or address,
I'm going to use the DNS name, vpn.barrierfaudio.com,
and that's because I have an A record created
for vpn.barrierfaudio.com that points
to the public IP address of our routing
and remote access server.
So, I'll go ahead and provide the name.
I'm going to leave the VPN type of Automatic.
This means that windows will try and use IKE v2,
and then if it's unable to use IKE v2,
it'll fall back to using SSTP.
Now, I'll go ahead and provide a username
of a domain user and their password.
We'll go ahead and click Save.
And then, we'll go ahead and connect.
Now, when this VPN connects,
it'll actually disconnect our remote desktop session
because of the way I've got the network configured,
but we'll go ahead and confirm that we're connected
using the Routing and Remote Access Server.
We'll go ahead and connect now.
All right, it's now connected
and it's disconnected our remote desktop session.
So, let's jump across to our Routing
and Remote Access Server.
All right, and here we are back
on our Routing and Remote Access Server.
We'll go ahead and select Remote Access Clients
and we can see we have our remote access
client connected via VPN.
All right, that concludes this demo.
Now, let's go ahead and wrap up with a bit
of a summary of what we've covered in this lesson.
So, what have we covered?
Network Policy Server network policies are used
to authenticate and authorize network access,
and connection request policies determine which RADIUS
server or servers should process authentication requests.
And network policies, determine who can connect
and under what conditions they can connect.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found this useful
and I look forward to seeing you in the next lesson.