To continue our configuration,
we'll open the Routing and Remote Access management console,
and since I just installed the role here with the management console open,
I'm just going to choose Refresh.
And now you'll see that the little, it's a tiny,
teeny tiny little arrow there, but it's an up arrow indicating the service is up,
so services are running on this, but again,
this is the default out‑of‑the‑box configuration.
There's some additional work that we need to do.
So, to begin, we're just going to right‑click here and choose Properties,
and then we'll, first things first, go to the Security tab.
And for our Authentication provider we want to choose RADIUS.
And then we'll click Configure, and here we want to add our RADIUS server,
or our NPS server that we provisioned previously.
So I'm going to enter that server's FQDN here,
and then I'm going to click Change here next to Shared secret,
and I'm going to paste that super long complex password
that we created earlier in this module, so I'm going to click OK.
And the default settings here are just fine,
so we'll click OK, and we are good to go.
I'm going to repeat this process for the Accounting provider.
So we'll choose RADIUS Accounting, choose Configure,
and once again add the server, provide the shared secret,
and we're good to go.
And you'll notice that there's a slight delay when we do that.
There's some validation that takes place in the background,
so don't worry about that.
Next thing we want to do is go to Authentication Methods,
and we want to uncheck MS‑CHAP v2.
We don't want to support usernames and passwords.
Again,
we want to use EAP authentication and we want to use certificates within EAP.
Since we're also going to be supporting device‑based connections,
so device tunnels,
we want to select the option Allow machine certificate authentication for IKEv2,
so we'll click OK.
In the SSL Certificate Binding section,
click on the drop‑down list next to Certificate and choose the
correct certificate for the public SSL certificate,
so the public SSL certificate is what gets assigned here.
Now, here's the trick, both of these certificates have the same name,
so there's no way to differentiate from them here,
but we'll select one of them and click View,
and we'll see if it's the right one.
Is it?
It is.
In this case it is issued by GeoTrust.
It's our public. If we were to select the wrong one,
click View, this is our internal CA,
so this is not the correct certificate to assign to
the SSL or the SSTP certificate.
We want to assign our public certificate,
so we'll select that one, click View, just make sure it's our public,
and then click OK and we're good to go.
Now let's go over to our IPv4 tab,
and here we want to assign a Static address pool.
This is the recommended method of provisioning IP addresses to our clients.
And here I'm just going to select a unique subnet environment.
It's not in use anywhere else.
And since I'm not supporting a ton of users,
I'm just going to carve out a simple /24 here.
So the general recommendation here is to carve these
subnets along subnet boundaries,
but there's no hard and fast requirement to do that.
So if you just wanted to do a range, you certainly could do that,
but here I try to keep things neat and tidy.
I've reserved this /24 from my IP address management platform.
I'm going to keep this whole /24 and all of its addresses assigned here.
And, again, you'll use usable addresses,
so don't include network addresses or broadcast addresses here.
So click OK.
And then, if this is a multi‑homed server,
we want to ensure that our internal or LAN interface is selected,
so we'll select LAN there.
And then we'll go to IPv6, and if you're using IPv6,
then we'll need to supply a prefix for address assignment here.
So I'm going to do that now.
And, once again, much like IPv4,
this IPv6 prefix must be unique in your environment.
And then same thing here,
I'm going to select the internal interface network
adapter in this selection box here.
And at this point we're good to go, so we can click OK.
And this is just basically a warning message saying,
hey, you've configured some things that you might want to know more about.
There's some authentication methods here that it's telling
you you should look at the help for.
If you wish to do that, great, click Yes.
We don't need that, so I'm going to go ahead and click No.
And then of course it will prompt you to restart the services.
The changes that we made do require a service restart, so we'll click Yes. Once that's done, click OK to continue.