Now let's configure high availability for our NPS infrastructure.
So to begin, we're going to export the NPS policy from our existing NPS server.
This is the NPS server that we created earlier in this course.
To export the configuration,
just open the Network Policy Server management console,
right‑click where it says server name Local,
and then choose Export Configuration.
Check the box that says, I'm aware I'm exporting shared secrets,
and the reason they're warning you here is that this XML
configuration file includes all of the settings,
but it also includes potentially sensitive information,
specifically, the shared secrets between the VPN servers and the NPS servers.
Those are stored in plain text,
and so you'll want to take good care of this file.
Don't leave it around needlessly.
So, let's go ahead and click OK, and then we'll just place this on the Desktop,
and then click Save.
You also have the option of exporting the policy using PowerShell.
To do that, we'll just open an elevated PowerShell command window,
and the command to do this is actually very simple.
It's export‑NpsConfiguration.
Specify the path and make sure it's in XML file format.
Hit Enter and you're good to go.
So here we are on our new NPS server,
and I've copied the NPS export file over to the desktop,
here as you can see.
And the first thing I want to do is I want to make sure that this
server has been enrolled for the certificate.
So I've built the server, I've joined it to the domain,
I want to make sure that it's enrolled for its certificate correctly.
So I'm going to open up the local computer certificate store,
and here we want to expand personal and certificates,
and here I should see a certificate enrolled for
with the template for NPS Servers.
So this certificate is installed correctly.
We could proceed with installing the role and configuring it.
So to do that, I'm going to open an elevated PowerShell command window.
And again, this server is already joined to the domain.
We validated that it has its certificate,
so now we're going to install the NPAS,
or Network Policy and Access Service role.
And once complete, let's open up the Network Policy management console,
and once again, I'm going to right‑click,
choose Import Configuration,
and then find that XML file that we created previously,
and you can click OK on this warning message; we
are not using SQL Server logging.
The bottom line is here we should now see our RADIUS clients
are there, and we look at our policies, and all of our policies
are in place, and this server is now ready to begin accepting
authentication requests.
Finally, once the NPS server is configured,
we need to update the configuration on the VPN server to support this.
So here we are on our VPN server, and we'll right‑click on the server
and choose Properties. We'll select Security, and then next to RADIUS
on Authentication, we'll click Configure. And here we have our first
server configured, so I'm going to click Add, and we're going to add
our second server. And since we exported our configuration and
imported it, the shared secret remains the same.
So I'm going to grab that and we'll just paste that in here, and then click OK.
And we'll click OK once more, and now you'll see we have two servers, and
they both have an initial score of 30, and that's fantastic if you want to
do round‑robin load balancing between these two.
So in this scenario,
the VPN server prefers the NPS server with the highest
initial score, and if they have the same score,
it'll just round‑robin between the two.
Now, this may work great, but if, for example, nps2 was in a remote
location, then I would certainly want to prefer nps1 over nps2.
So in other words, use nps1 unless it didn't respond, and then use nps2.
In that scenario,
I would just simply lower the initial score for the second server,
and we'll set it to something lower like 20.
So here in this scenario,
nps1 would always be preferred, and it would always respond, but if it
does not respond, then it will send the request to nps2.
So in that scenario you could prefer a more local NPS server, unless it
wasn't available, and then use a remote server as fallback.
So we'll click OK, and then we're going to repeat this
process for the accounting provider.
The last bit of configuration that has to be done is on the
endpoint itself. Recall that when we set up our client
configuration, we defined which NPS servers it was allowed to
talk to, so we need to update that setting.
So let's go into our VPN settings, and here, I'm going to
click on Change adapter options because I need to get to
the more advanced settings.
So we're going to right‑click our VPN connection,
choose Properties,
go to the Security tab, and under protected EAP here, I want to select
Properties, and here's where you'll see that we supplied that
information previously. So you can add multiple names here; they just
have to be separated by a semicolon.
So I'm going to add my second NPS server here. Then I'm
going to copy this whole string here.
We'll go down here to click Configure, and then I'm going to paste this string
in here as well, because they need to be in both places.
So once that's done, we'll click OK, click OK once more, and OK.
And at this point, the client configuration is complete.
Now, of course, if you're deploying this with PowerShell or with Intune,
you need to update the settings there.
So again,
following those steps as we outlined previously in this course, you'll
export the XML configuration, and then upload that to Intune into the
device configuration profile, and then once your clients synchronize,
then they'll be able to support that.
Now,
the challenge here is when you're migrating these settings, I would encourage
you to deploy the new NPS server configuration settings to your endpoints
prior to adding the new server on the back end.
That way,
you don't get an issue where once you add the NPS
server to the VPN server configuration,
your clients are going to start complaining.
So you want to front load those clients with that
information first, deploy those settings using Intune or
XML, and then once everybody has them,
then you can update the VPN server configuration and there shouldn't be any complaints from your endpoints.