So let's get onto the demonstration of optimizing our VPN server configuration.
So, we have a number of fine tuning and optimization tasks to accomplish
here, and the tool of choice for this is going to be,
you guessed it, PowerShell. I have made your life infinitely easier to do all of
these tasks because I have created a PowerShell module called AOVPNTools that I
use when I'm working with my customers to deploy Always On VPN. I've automated
many of these tasks. Some of them are, you know,
configuration settings,
some of them are registry keys. Regardless, I have created a number of
tools to just kind of help automate this process.
Now,
the best way to start is to install this PowerShell
module, and so you will run the command,
Install‑Module, and then the module name is AOVPNTools. And at this point,
you just hit Enter, and you are off to the races. Now,
there is a variety of things that happen here. You'll have to
install the NuGet provider. You might have to accept the publisher
check and things of that nature, but I have screened all of that for
the purposes of being expedient here and getting things done
quickly. At the end of the day,
I've installed the module here on this server, and we're ready to go.
So the first thing that we need to do is configure our VPN ports.
Now, if we look at this in the UI, let's take a quick look,
you'll see that the port configuration here, if we
highlight Ports and choose Properties, there's a number of different ports.
Again, the default is 128. Some of them we don't need like L2TP and PPTP.
Some of them are used by RAS, some are used by RAS and Routing.
And again, we could walk through this UI and fine tune all of this.
But again, as I said before,
I've made this much easier by just using PowerShell. So the
PowerShell command that we want to use here is called
Set‑VpnServerPortConfiguration.
And in this case, I want to define my SstpPorts. And in this case,
I'm just going to choose a round number of 500,
let's say, and then a value for my IKEv2 ports because I'm
also supporting the device tunnel here.
Now, it's important to remember, the number of ports you define is
the number of available ports for that protocol.
So if I'm expecting 500 concurrent users split up between a
combination of user and device‑based connections,
I may not need 500 each.
My recommendation here is to over provision. There's no
real penalty for over provisioning here.
So if you're expecting 500 concurrent users, assign 500 for both. It
really doesn't hurt anything. Always better to over provision than
under because, obviously, you're going to have some issues if you run
out of ports. But if I have too many,
it doesn't really consume a lot of extra resources. So I'm going to choose
500 here. And in this case, I'm also going to supply the restart switch so
that the change takes effect immediately.
So as I mentioned earlier,
the default security settings for IKEv2 IPsec out of the box for Windows
Server leave a little bit to be desired. By default, Windows Server
supports 3DES for encryption, or TripleDES, SHA‑1 for integrity, and
Diffie Hellman Group 2 for RSA key size, and that's a 1024‑bit key size
defined as Diffie Hellman Group 2.
Those may have been perfectly valid and acceptable security
parameters in the earlier mid 90s. Today, it's certainly not
going to fly. At a minimum,
we recommend that you use AES‑128. And beginning in Windows Server 2019,
Microsoft added support for GCM AES‑128 with RSA keys,
which is kind of the default standard.
And so if you're using Windows Server 2019 and later, you
can take advantage of that, and I'll show you how to do
that here in just a few minutes.
We also recommend using SHA‑256 for integrity, and minimum
key size today for RSA should be 2048 bit, which is defined
as Diffie Hellman Group 14.
So to update the default IKEv2 IPsec security settings on Windows Server,
we're going to run the command, Set‑IKEv2VpnSecurityBaseline. And if you
run this command as is without any parameters, it will install the
minimum recommended baseline security parameters, which would be AES‑128,
SHA‑256, and Diffie Hellman Group 14.
However,
if you are running on Windows Server 2019 and later, it's best to use
the enhanced security switch. And when you do this,
it will take advantage of GCM AES‑128, which provides a
little bit better security and integrity.
However, if you're running Windows Server 2012, 2012 R2 or 2016,
you can't take advantage of this. It won't work in those versions of Windows.
You must have Windows Server 2019 or later to run this. We'll also add the
restart switch so these changes will take effect immediately.
Once that's complete, let's move on to defining our root certificate.
Now, we need to gather a bit of information for this.
So here, we need to go back to our Local Computer certificate store.
And what I want to do is I want to go to my Trusted Root CA,
choose Certificates, and I want to find the certificate for my
enterprise PKI, and here it is right here.
Now, there are some scenarios where, and again this is a clean lab, so
there's only one certificate, but you may find that you have multiple
certificates here. If you've renewed your root or issuing CA certificates,
you may have also deployed more than one for whatever reason. There may be
some challenges or issues. You might see several of them and you need to
know exactly which one.
So the best way to do this is actually to go look at the
certificate that you issued for IPsec.
So we'll double‑click on that.
We'll go to Certification Path, and we're going to go to the root CA
of the certificate that was issued for IPsec. So on this server,
we'll select this certificate, and we'll choose View Certificate.
Then we'll go to Details and scroll to the bottom here and then find
our Thumbprint value.
We need to copy this to the clipboard because this is the root certificate
that we want to trust for our device‑based authentication.
So we'll click OK. And we're going to run the command
Set‑IKEv2VpnRootCertificate, and we're going to supply the
thumbprint that we just paste copied there.
So I'll paste that on the command line, and we'll add
the restart command here as well.
And that's it.
The next thing we want to do is, as I mentioned before,
we want to enable IKEv2 fragmentation.
So that command is Enable‑VpnServerIKEv2Fragmentation Once
again, the restart switch if you like.
And finally, the last command that we need to run is enabling the CRL check.
That command is Enable‑IKEv2CrlCheck, and we'll add the restart switch once again.