Configuring VPN1
Applies To: Windows 7, Windows Server 2008 R2
VPN1 is a computer running Windows Server 2008 R2 that provides the following roles and services:
Active Directory Certificate Services, a certification authority (CA) that issues the computer certificate to a VPN server required for a remote connection with VPN Reconnect.
Certification Authority Web Enrollment, a service that enables the issuing of certificates through a Web browser.
Web Server (IIS), which is installed as a required role service for Certification Authority Web Enrollment.
Network Policy and Access Services, which provides support for VPN connections through NPS and RRAS.
VPN1 configuration consists of the following steps:
Install the operating system
Configure TCP/IP
Name the computer and join the Contoso domain
Install Active Directory Certificate Services and Web Server
Create and install the Server Authentication certificate
Install Network and Policy Access Server Role
Configure Routing and Remote Access
Configure the Network Policy Server (NPS) to grant access for EAP-MSCHAPv2 authentication
The following sections explain these steps in detail.
Install the operating system
VPN1 must run Windows Server 2008 R2.
To install Windows Server 2008 R2
On VP1n, start your computer using the Windows Server 2008 R2 product disc.
Follow the instructions that appear on your screen.
When prompted to provide a password for the Administrator user account, type Pass@word1
After installation completes, and the Initial Configuration Tasks window appears
Note
If the Initial Configuration Tasks window does not appear, or if you closed it after selecting Do not show this window at logon, you can start it by clicking Start, typing oobe in the text box, and pressing ENTER.
Configure TCP/IP
Configure TCP/IP properties so that VPN1 has a static IP address of 131.107.0.2 for the public (Internet) connection and 192.168.0.2 for the private (intranet) connection.
To configure TCP/IP properties
On VPN1, in the Initial Configuration Tasks window, under 1. Provide Computer Information, click Configure networking.
In the Network Connections dialog box, right-click the connection for the adapter that is connected to the public (Internet) network, and then click Properties.
On the Networking tab, click Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
Click Use the following IP address, and configure the following settings:
In IP address, type 131.107.0.2.
In Subnet mask, type 255.255.0.0.
Do not configure a default gateway or DNS server on this connection.
Click OK twice to return to Network Connections.
Right-click the connection for the adapter that is connected to the private network, and then click Properties.
Click Use the following IP address, and configure the following settings:
In IP address, type 192.168.0.2.
In Subnet mask, type 255.255.255.0.
Do not configure a default gateway on this connection.
In Preferred DNS server, type 192.168.0.1.
Click OK twice to return to Network Connections.
To rename the network connections, right-click a network connection, and then click Rename.
Rename the network connections with the following names:
On the interface connected to the public (Internet) network, type Public.
On the interface connected to the private (intranet) network, type Private.
Close the Network Connections window.
Use the ping command to verify network connectivity between VPN1 and DC1, and to verify that VPN1 can use DC1 for name resolution.
To use the ping command to check network connectivity
On VPN1, click Start, click Run, in the Open box, type cmd, and then click OK. In the Command Prompt window, type ping dc1 /4.
Verify that you can successfully ping DC1.
Close the Command Prompt window.
Name the computer and join the Contoso domain
Configure VPN1 with its name, and join it to the Contoso.com domain.
To name VPN1 and join it to the Contoso.com domain
- On VPN1, in the Initial Configuration Tasks window, under 1. Provide Computer Information, click Provide computer name and domain.
Note
If the Initial Configuration Tasks window is not already open, to open it, click Start, click Run, type oobe in the text box, and then click OK.
In the System Properties dialog box, on the Computer Name tab, click Change.
In Computer name, clear the text and type VPN1.
In Member of, click Domain, type contoso, and then click OK.
Enter administrator for the user name and Pass@word1 for the password.
When you see a dialog box welcoming you to the contoso.com domain, click OK.
When you see a dialog box telling you to restart the computer, click OK. Click Close, and then click Restart Now.
Install Active Directory Certificate Services and Web Server
To support IKEv2-enabled VPN connections, first install the Active Directory Certificate Services and Web Server (IIS) server roles to enable Web enrollment of a computer certificate.
To install the certificate services and prerequisite roles
After VPN1 restarts, log on as contoso\administrator with the password Pass@word1.
In the Initial Configuration Tasks window, under 3. Customize This Server, click Add roles.
Note
If the Initial Configuration Tasks window is not already open, to open it, click Start, type oobe in the text box, and then click OK.
In the Add Roles Wizard dialog box, on the Before You Begin page, click Next.
On the Select Server Roles page, select Active Directory Certificate Services, and then click Next.
On the Introduction to Active Directory Certificate Services page, click Next.
On the Select Role Services page, select both Certification Authority and Certification Authority Web Enrollment.
In the Add role services and features required for Certification Authority Web Enrollment? dialog box, click Add Required Role Services.
Click Next.
On the Specify Setup Type, select Enterprise, and then click Next.
On the Specify CA Type page, select Root CA, and then click Next.
On the Set Up Private Key page, select Create a new private key, and then click Next.
On the Configure Cryptography for CA page, click Next to accept the default cryptographic settings.
On the Configure CA Name page, click Next to accept the default CA common name and suffix.
On the Set Validity Period page, click Next to accept the default validity period.
On the Configure Certificate Database page, click Next to accept the default locations.
On the Web Server (IIS) page, click Next.
On the Select Role Services page, click Next to accept the default choices.
In the Confirm Installation Selections dialog box, click Install. The installation might take several minutes.
In the Installation Results dialog box, click Close.
Create and install the Server Authentication certificate
The Server Authentication certificate is used by CLIENT1 to authenticate VPN1. The certificate must have the “Server Authentication” and “IP security IKE intermediate” extended key usage (EKU) options applied.
To create a certificate template with the required EKUs
On VPN1, click Start, click Administrative Tools, and then click Certification Authority.
In the navigation tree, expand contoso-VPN1-CA.
Right-click Certificate Templates, and then click Manage. The Certificate Templates Console appears.
Right-click the IPsec template in the list, and then click Duplicate Template.
In the Duplicate Template dialog box, select Windows Server 2003 Enterprise, and then click OK.
On the General tab, change the Template display name to VPN Reconnect.
Check the Validity period. The default is 2 years. You can adjust this per your organization’s requirements.
On the Request Handling tab, select Allow private key to be exported.
On the Subject Name tab, select Supply in the request. If a warning message appears, click OK.
On the Extensions tab, select Application Policies, and then click Edit.
The IP security IKE intermediate policy is already present. Keep it. If there are any others, select them and click Remove.
Click Add, select Server Authentication, and then click OK.
Click OK to return to the Extensions tab.
Select Key Usage, and then click Edit.
In the Signature section, ensure that Digital signature is selected. If it is, click Cancel. If it is not, select it, and then click OK.
Click OK to save your completed template.
Close the Certificate Templates Console window.
The certificate template has been created. It must be issued before it can be used to request a certificate.
To issue the certificate template
In the Certification Authority console window, right-click Certificate Templates, click New, and then click Certificate Template to Issue.
In the Enable Certificate Templates dialog box, select VPN Reconnect, and then click OK.
The template is now ready to be used for certificate requests. Before you can request one, you must configure Internet Explorer security settings to work with the certificate publishing web page.
To configure Internet Explorer to allow certificate publishing
On VPN1, click Start, right-click Internet Explorer, and then click Run as administrator.
Click Tools, and then click Internet Options.
On the Security tab, under Select a zone to view or change security settings, click Local intranet.
Change the security level for Local intranet from Medium-low to Low, and then click OK.
Note
In a real-world scenario, you should configure individual ActiveX® control settings using Custom level rather than lowering the overall security level.
Internet Explorer is now ready to be used to request and install certificates on the local computer.
To request a Server Authentication certificate using Internet Explorer
On VPN1, in the Internet Explorer address bar, type https://localhost/certsrv, and then press ENTER.
Under Select a Task, click Request a Certificate.
Under Request a Certificate, click Advanced Certificate Request.
Under Advanced Certificate Request, click Create and submit a request to this CA.
On the first confirmation dialog box, click Yes to allow the ActiveX control.
On the second confirmation dialog box, click Yes to allow the certificate operation.
In the Certificate Template list, select VPN Reconnect.
Under Identifying Information, in the Name field, type vpn1.contoso.com.
Note
The name is the certificate subject name and must be the same as the Internet address used in the IKEv2 connection settings configured later in this document.
Under Key Options, select Mark keys as exportable, and then click Submit.
Click Yes in each of the confirmation dialog boxes.
The server authentication certificate is created in the user personal store. It must be moved to the machine store to be used.
To move the certificate to the machine store
On VPN1, click Start, type MMC, and then press ENTER.
In Console1, click File, and then click Add/Remove Snap-in.
Under Available snap-ins, click Certificates, and then click Add.
Click Finish to accept the default setting of My user account.
Click Add a second time, click Computer account, and then click Next.
In the Select Computer dialog box, click Finish to accept the default setting of Local computer.
Click OK to close the Add or Remove Snap-ins dialog box.
In the navigation tree, expand Certificates - Current User, expand Personal, and then click Certificates.
In the details pane, right-click the vpn1.contoso.com certificate, click All Tasks, and then click Export.
On the Welcome page, click Next.
On the Export Private Key page, click Yes, export the private key, and then click Next.
On the Export File Format page, click Next to accept the default file format.
On the Password page, type Pass@word1 in both text boxes, and then click Next.
On the File to Export page, click Browse.
Under Favorites, click Desktop
In the File name text box, type vpn1cert, and then click Save to save the certificate to the desktop.
Back on the File to Export page, click Next.
On the Completing the Certificate Export Wizard page, click Finish to close the wizard, and then click OK in the confirmation dialog box.
In the console tree pane, expand Certificates (Local Computer), and then expand Personal.
Right-click Certificates, point to All Tasks, and then click Import.
On the Welcome page, click Next.
On the File to Import page, click Browse.
Under Favorites, click Desktop.
In the file type drop-down list, select Personal Information Exchange (*.pfx, *.p12).
In the list of files, double-click vpn1cert.
Back on the File to Import page, click Next.
On the Password page, type Pass@word1, and then click Next.
On the Certificate Store page, click Next to accept the Personal store location.
Click Finish to close the Import Export Wizard, and then click OK in the confirmation dialog box.
To generate the trusted root certificate
On VPN1, in the Internet Explorer address bar, type https://localhost/certsrv, and then press ENTER.
Under Select a task, click Download a CA certificate, certificate chain, or CRL.
Click Yes to allow the ActiveX control, and Yes to allow the certificate operation.
Click Download CA certificate.
Click Save, select Desktop, type the name RootCACert, click Save, and then click Close. Later, you will move this certificate to the Client1 computer.
Important
The root certificate for the CA is already installed on VPN1, because the root certificate for a CA is installed when the computer is made a CA. If your CA is a separate computer from VPN1, then you must separately download and install the root CA certificate to VPN1.
Install Network and Policy Access Server Role
Configure VPN1 with Routing and Remote Access to function as a VPN server.
To install the NPS and RRAS service roles
- On VPN1, in the Initial Configuration Tasks window, under Customize This Server, click Add roles.
Note
If the Initial Configuration Tasks window is not already open, you can open it by clicking Start, typing oobe in the text box, and then clicking OK.
On the Before You Begin page, click Next.
On the Select Server Roles page, click Network Policy and Access Services, click Next.
On the Network Policy and Access Services page, click Next.
On the Select Role Services page, select both Network Policy Server and Routing and Remote Access Services, and then click Next.
On the Confirm Installation Selections page, click Install.
On the Installation Results page, click Close.
Now that the services are installed, you can configure them.
Configure Routing and Remote Access
Configure VPN1 to be a VPN server providing remote access for Internet-based VPN clients.
To configure VPN1 to be a VPN server
On VPN1, click Start, point to Administrative Tools, and then click Routing and Remote Access.
In the navigation tree, right-click VPN1 (local), and then click Configure and Enable Routing and Remote Access.
On the Welcome to the Routing and Remote Access Server Setup Wizard page, click Next.
On the Configuration page, click Next to accept the default setting of Remote access (dial-up or VPN).
On the Remote Access page, select VPN, and then click Next.
On the VPN Connection page, under Network interfaces, select Public. This is the interface that will connect VPN1 to the Internet.
Clear the option Enable security on the selected interface by setting up static packet filters, and then click Next.
Note
In a production environment, you should leave security enabled on the public interface. For the purposes of testing lab connectivity, you should disable it.
On the IP Address Assignment page, select From a specified range of addresses, and then click Next.
On the Address Range Assignment page, click New.
On the New IPv4 Address Range dialog box, in Start IP address type 192.168.0.200, in End IP address type 192.168.0.210, click OK to add the range, and then click Next. (This is the set of IP addresses available to assign to VPN clients).
On the Managing Multiple Remote Access Servers page, click Next to accept the default setting of not working with a RADIUS server. In this scenario, RRAS uses Windows Authentication.
On the Completing the Routing and Remote Access Server Setup Wizard page, click Finish.
On the warning about possible NPS policy conflicts, click OK.
On the warning about the need to configure the DHCP Relay Agent, click OK.
Configure the Network Policy Server (NPS) to grant access for EAP-MSCHAPv2 authentication
Configure VPN1 by using Network Policy Services (NPS) to enable and configure the remote access policies required for an IKEv2-based VPN connection.
Note
You can choose to have NPS installed on any other server also have the NPS installed on DC1 or any other server. NPS running on Windows Server 2008 is also supported. For the sake of simplicity in this guide, we are deploying it on VPN1.
IKEv2 supports both machine certificate and EAP based authentication. NPS is required to when using EAP-based authentication, and is not required when using machine certificate based authentication.
Configuring the NPS server
click Start, point to Administrative Tools, and then click Routing and Remote Access.
On VPN1, in the Routing and Remote Access navigation tree, expand VPN1 (local).
Right-click Remote Access Logging & Policies, and then select Launch NPS.
In the Network Policy Server window, in the Network Access Policies section, click the Network Access Policies link.
Double-click Connections to Microsoft Routing and Remote Access server.
On the Overview tab, in the Access Permission section, select Grant access. Grant access if the connection request matches this policy.
On the Constraints tab, in the Contstraints list, select Authentication Methods.
If Microsoft: Secured password (EAP-MSCHAPv2) is not present in the EAP Types list, then follow these steps:
Click Add.
In the Add EAP dialog box select Microsoft: Secured Password (EAP-MSCHAP v2), and then click OK.
Select Microsoft: Smart Card or other certificate and click Remove to remove the EAP type.
Click OK to save your changes.
Close the Network Policy Server window.