Next, we'll click Configure,
and we want to select the option to Use a certificate on this computer.
Simple certificate selection is fine.
And once again, you'll see very much the same menus that we saw before,
Verify the server's identity, Connect to these specific servers.
And the reason we're kind of repeating this here is that Protected
EAP essentially establishes a secure tunnel,
TLS encrypted actually, and sometimes it's actually referred to as EAP TLS.
But principally,
we're establishing a secure channel within that tunnel we
are now going to exchange our credentials,
and we want to again perform validation just to
ensure that there's no problems here.
So we're going to enter the NPS server's hostname again,
and we're also going to select our root CA.
And once again here, you'll see that there's another prompt that says,
Don't prompt users to authorize new servers.
And once again, we definitely want that.
We don't want users taking these security decisions into their hands.
We want to make them for them.
We're going to say Don't prompt.
We want this connection to fail. Call the help desk, and
we'll sort it out from there, but don't connect to, you
know, an insecure server for sure.
Next, we're going to go ahead and click Advanced. And this is
optional, but highly recommended is to enable Certificate
Issuer for our certificate selection.
In many cases, you're going to have more than one user authentication
certificate in the user store. In ours, we have, again, this is a really clean
lab, we just have a single certificate, but you might have a number of
different certificates issued by maybe your PKI, but maybe other PKIs as well,
and so we want to ensure that the client knows which certificate to use
specifically for this VPN connection.
So we're going to enable Certificate Issuer. We're going to go down here and
select our root CA. And by the way, I'm selecting the root CA, but you can
also select and get more granular and select your individual issuing CA. If
you want to go that far, that's great.
If you have multiple issuing CAs, you might want to just step back
and use the root CA, and that should be sufficient.
Next, select Extended Key Usage here, and then uncheck
All purpose and uncheck Any Purpose.
We don't need either of those EKUs.
We only want the Client Authentication EKU. So, in this
configuration, when this connection is established,
the VPN client will look for a certificate issued by this CA that
has the Client Authentication EKU, and that should be more than
sufficient in most cases to identify the proper certificate and
present that for authentication.
So we'll click OK and OK out of that a few times, and we're good to
go. Next, we're going to go here to the Networking tab, and we'll
select IPv4 and choose Properties and Advanced. And here, if you are
planning to test a force tunnel scenario, there's nothing that you
need to do here.
This option, Use default gateway and remote network,
basically should say force tunneling.
This is enable force tunneling, send everything over the tunnel.
Since we're going to use split tunneling here because that's the most
common deployment model, I'm going to uncheck this option, but I'm also
going to disabled class based route addition.
And what that means is that a class‑based route is added by the VPN client when
the connection establishes, and to really put it bluntly,
it just guesses at what the best route is.
It basically adds a route that's based on the IP address that it was assigned.
Sometimes it works,
sometimes it doesn't. It's often less than ideal, so we want to
be very explicit and add our own specific routes, and we're
going to do that in just a second.
So check the box, Disabled class based route addition.
We're going to jump over to the DNS tab, and we also want to add our
internal DNS suffix to this particular VPN connection as well. So once that's done, click OK, and then we can just OK out.