So for validation testing, we're going to perform a couple of different tasks.
We're going to start by creating a test VPN connection.
We're going to do this manually on an endpoint.
We will validate that the endpoint has its prerequisites met.
We need to make sure that it has a client authentication certificate,
a device authentication certificate as well.
And then we're going to update our IPsec policy and our routing configuration.
If you recall,
we made some changes to the default settings on the
VPN server for IPsec because, again, the default settings are less than ideal.
So we made that change on the server side,
but we need to make a corresponding change on the client side.
And again, for testing purposes,
we're going to make this change locally just using PowerShell.
Later,
we'll actually input that information into our configuration files
or an Intune UI, but for now, we're going to use PowerShell to
update the IPsec policy locally so that it aligns with the settings
that are in place on the server.
We also need to update our routing configuration, and again, that's done
using PowerShell. And in a split tunneling scenario, of course, we need to
tell the VPN client what traffic is allowed over the VPN server, so we're
going to use PowerShell to add a couple of subnets to the the the VPN's
routing table so that that traffic will know to traverse the VPN, go to the
on‑premises resources using that path. We'll perform some connectivity
tests. We're going to obviously ensure that we can connect to the VPN
server from the internet. We want to make sure that once we connect that we
can authenticate successfully and that we can reach internal resources, so
we want to make sure that our network routing is functioning and so we can
reach internal services and so forth.
We also want to validate that SSO, or single sign‑on, is working, so we're going
to access some authenticated resources and make sure that we're not receiving
any authentication prompts or anything like that.
And then finally, we're going to export our EAP configuration.
The EAP configuration is not exactly trivial to configure. Thankfully,
we only have to do it once. And once that's done,
we'll export it to an XML file, and we'll use that XML file, or the
data in that XML file, when we provision our Always On VPN client settings using Intune or PowerShell.