And now we're going to go to our Policies,
and then we're going to highlight our Network Policies.
And once we're here,
we're going to right‑click and then just choose New and give it a policy name.
So this is going to be my Always On VPN access policy, so we'll call it that.
The type of network access server, select Remote Access Server(VPN‑Dial up).
Click Next.
And in the Conditions here, we want to specify our user group that we created.
So the Conditions mean anything that matches these
conditions will match this rule effectively,
right?
And so in this case,
we want our VPN users in this group to be able to be processed by this rule.
So we'll click Add, and we're going to select User Groups.
Click Add once more, click Add Groups, and then we're going to
add our group that we created previously.
So click OK and Next. Access granted.
Obviously, we want these users to be able to access the VPN and
the infrastructure, so we'll leave it at that.
Choose Next. And here we want to uncheck all of the less
secure authentication methods listed here.
We only want to use secure authentication methods. And specifically, that's
being EAP, and so we'll click on the Add button here in the EAP Types
field, and we're going to select Protected EAP.
This is the protocol of choice, so we're going to click OK.
And once that's done, we're going to highlight Protected EAP that
we just added here and then click Edit. And a couple of things that
we need to pay careful attention to.
First of all, the certificate is issued to the NPS server. Here we have a very
clean lab build. It has one certificate. It can't be wrong. In your
environment, you have may have multiple certificates here.
You need to ensure that the certificate that you use for the
NPS policy is issued by the same certification authority as the
user authentication certificates.
So you want to ensure that this is the correct certificate.
So you can validate that here by looking at the issuer and
the expiration date and so forth.
Unfortunately, there's no way to actually look at this
certificate, so you may have to do some deduction here to make
sure it's the right one in your environment.
Next, we will uncheck Enable Fast Reconnect.
Fast reconnect is a technology that's used for Wi‑Fi
predominantly. It certainly can be used for VPN, but it does kind
of short circuit or creates a shortcut for our authentication,
and specifically, reauthentication.
It's helpful for Wi‑Fi clients switching between access
points, not really ideal for authenticating users from an
untrusted network like the internet.
So uncheck that. I also suggest selecting the option
Disconnect Clients without Cryptobinding.
So cryptobinding is essentially a feature of the authentication
process that allows the peers to exchange some information to
ensure that they were both communicating directly with each other
during the authentication process.
And so cryptobinding is essentially if you think of it as like a almost like a
hash of all of the communication taking place during the authentication
process, and those hashes should match. If they do not,
it's likely that this connection was tampered with. So it
may have been intercepted, and so you would want a client
to disconnect as opposed to, you know, connecting and divulging credentials.
So here I'm going to select Disconnect Clients with
without Cryptobinding for best security.
Also, I want to remove the Secured password option here, and I want to add
Smart Card or other certificate because, again, we are using certificate
authentication for our users for high assurance.
So we're going to click OK and then click OK again, and we're done here.
So we'll click Next, we'll click Next once more, and again, and then Finish.
And that's it.
We've defined our Always On VPN network access policy,
an authentication request from the VPN server coming to this
NPS server, if it matches these conditions, should be good to go.