Once that's done, let's go ahead and install the role,
and to do that, once again, I'm going to use PowerShell.
And again, just as a reminder,
we're going to install the Windows feature and the feature is
directaccess‑vpn and will include the Management Tools.
(Typing) And next,
we will configure the remote access service. (Typing) Once that's complete,
we can import the configuration.
So I'm going to navigate to the desktop where that configuration file is,
and the command to import the configuration is just simply
netsh.exe exec and the name of the file.
So once that's finished, we need to restart the remote access service,
and in this case, we actually need to start the RasMan service as well,
and if we restart the RasMan service and use the ‑force parameter,
we'll also restart the remote access service and that will completely install
that imported configuration. (Typing) So at this point,
the bulk of the configuration has been imported,
but again, as I've stated previously, it doesn't bring over everything.
So let's go to the Routing and Remote Access Management console.
So at this point, I'm going to right‑click on the server and choose Properties.
I'm going to go to the Security settings,
and now I'm going to select, in the SSL Certificate Binding section,
I'm going to choose my public SSL certificate. So I'll click View,
make sure that's my public SSL certificate,
and then I also need to define my RADIUS server settings.
So if I click Configure here,
what you'll notice is that we have our server settings
that were imported from our first server,
however,
it doesn't bring over the shared secret so I would
have to input those there as well.
So I'm going to click Edit, click Change,
and even though it looks like, let me back up for a second,
it looks like I've actually got a shared secret there,
I don't, so I'm going to click Change,
and then I'm going to paste the shared secret there as accordingly.
So I'm going to click OK, I'm going to repeat that step here,
and then I will repeat those steps for the accounting providers as well.
So once that's done, I'm going to click OK,
and I'll be prompted to restart the service.
Finally,
I want to just make sure that my configuration came
over as expected because occasionally, sometimes things don't work out.
So I'm going to actually right‑click on Ports and choose Properties,
and I want to make sure that all of these are set correctly,
and what you'll see here, of course, is that one is not.
So I actually have, or I'm expecting 500 ports each.
In this scenario, sometimes, and I can't really explain this,
but for some reason,
some of these settings don't come over, like if I were to
look at this in the configuration file,
it would say 500 for the number of IKEv2 ports.
So here I'm just going to click Configure,
and I'm going to set this to what I expect.
We'll click OK.
It's going to ask me if I want to restart,
and again, this reboots the server so I'm going to choose No,
and I'm going to reboot that a little bit later.
So once that's done,
I'm going to reboot the server and we'll pick up the
configuration on the other side.
Now that the VPN server configuration has been imported,
there are a few outstanding configuration tasks that must still be completed.
Recall that earlier in this course,
we set up the first VPN server. We made some adjustments to
the security configuration. Specifically,
we defined the root of trust for IPsec authentication,
and we configured a custom IPsec policy.
Unfortunately,
neither of these settings come over during the configuration import
so we'll have to make those changes here manually.
Now, as a reminder,
we made both of those changes using my AO VPN Tools PowerShell module,
which I've already installed on this server.
So to define the root of trust for IPsec,
we need to run the command Set‑IKEV2VpnRootCertificate and supply the
thumbprint of our trusted root certification authority.
Next, we'll run the Set‑IKEv2VpnSecurityBaseline command with the
‑EnforceIKEv2CrlCheck and the ‑EnhancedSecurity parameters.
This will define our custom IPsec policy like we configured on the first server.
And once that's done, we'll restart the remote access service, and we'll be done with the configuration.