The core components of an Always On VPN infrastructure
are VPN servers and RADIUS Servers.
VPN servers are the primary component and they're used for
terminating VPN connections from clients on the internet.
The most popular option for VPN services is using Windows Server,
and specifically, the Routing and Remote Access Service,
or RRAS.
RRAS has been around for many, many years and is quite stable.
It's also the most popular deployment option simply because it's,
it's just very easy to deploy and manage,
it scales well, and it's very cost effective.
There is no user licensing or per device licensing required for using RRAS.
However, as I stated before,
Always On VPN is infrastructure independent and you're by no
means limited to using Windows Server.
You can certainly use non‑Microsoft devices,
such as VPNS or firewalls from Cisco, Palo Alto,
Checkpoint, a variety of different vendors as well.
There are some limitations associated with this,
and we'll talk about those in detail a little bit later.
If you plan to use a non‑Microsoft VPN,
there is a couple of unique and very specific requirements to support this.
First of all, you must use the native VPN client.
This is the client software that's built into Windows,
and of course, if you do this, you must use the IKEv2 VPN protocol.
IKEv2 is an open standard and allows you to interoperate and integrate with a
variety of different firewalls that are available to you.
You can also use the plugin provider or plugin VPN client if
your third‑party firewall vendor supports that.
These are client software components that are available in the Microsoft store,
and the advantage to using the plugin provider is that it uses TLS,
which is a more firewall‑friendly protocol than IKEv2.
Today,
there are a number of firewall and load balancer vendors that support
plugin providers for Windows 10 and Windows 11 VPN.
The second critical component for Always On VPN
infrastructure is the RADIUS Server.
The RADIUS Server is used to provide authentication for our VPN
clients that are connecting to the VPN server.
Here again, Windows Server provides probably the best option,
certainly the most common one, and by the way,
we'll be covering Windows Server exclusively in this course.
In Windows Server,
Microsoft's implementation of RADIUS is known as
Network Policy and Access Services, or NPAS,
sometimes just referred to as NPS,
and we'll use that throughout the course to create
our network connection policies.
But here again, you're not limited exclusively to using Windows Server.
You can use any non‑Microsoft radius server you choose as long as it
supports the open industry standard RADIUS protocol.
There are RADIUS server offerings available from a wide number of vendors,
both commercial and open source that you can choose from.
In terms of the Windows Server requirements,
the VPN server, I would suggest using a minimum of Windows Server 2019.
You can certainly deploy this on 2016 and even 2012 and 2012 R2 if you like,
but there are some critical components that are available in
server 19 or that were introduced in server 19,
2019, that might be helpful to you.
Domain‑join is optional.
If you're going to put it on a LAN, I would certainly recommend that,
but if you want to put it in a perimeter or DMZ network,
I would recommend not joining that to a domain, and VPN server,
or the RRAS services supported on both Server GUI and Server Core.
I'm a huge fan of server core.
I advocate for that whenever possible,
but fully understand that not every administrator is
comfortable or even familiar with administering a Windows
Server exclusively from the command line.
So in in our course here on Pluralsight,
we're going to cover the Server GUI model.
As for the NPS Server,
you can run NPS on any supported version of Windows Server,
it does require that it be joined to your domain because it's going
to perform authentication against the domain,
so it has to be able to do that,
it has to be able to talk to domain controllers and whatnot.
The Network Policy Server, or NPS, is supported on server GUI only.
It is not supported on Windows Server Core, so you must run this on the server GUI version.