Implementing high availability for NPS is pretty straightforward.
Essentially,
what's involved is deploying additional Windows servers joined to the
domain and then installing the NPS role and making sure any
certificates are in place to support authentication.
Next, we'll export the NPS policy from an existing NPS server.
So we have a functioning NPS server to our environment,
we'll grab the policy from there, and you can export the policy using the UI,
you can do that right in the NPS Management console or
you can use PowerShell if you like.
Next,
we'll go and take this policy over to our
newly‑provisioned NPS server and we'll import it,
and again, you can use the UI to do that or,
once again, you can use PowerShell.
Next, we'll need to update the server configuration on the VPN server.
Specifically, we need to tell the VPN server,
we have a new NPS server that supports authentication
requests, and so we will add the servers FQDN,
its shared secret, and so forth.
Once that's done,
we can also finetune the policy to determine how our
authentication requests are routed.
So it's recommended that an NPS server be local to the VPN
server to support prompt authentication requests.
We want high throughput, low latency between them.
However, you might have a failover NPS server in a remote data center,
and so you might prefer the locally connected NPS server until it's unavailable
and then failover to a remote VPN server in that scenario,
and the idea there is that it's obviously better to have
slow authentication than no authentication.
Finally, we need to update the client configuration as well.
We need to tell the VPN client that there are additional NPS
servers that are authorized for authentication.
Recall that when we set up our EAP configuration initially,
we actually put the host name of the NPS server in the EAP configuration.
This is the only NPS server that it's allowed to talk to in this scenario.
It would fail if we added another one.
So here,
we just need to simply update the client configuration to let it
know that there are additional authorized NPS servers that are available to support authentication.