1

I quite don't know where to start so I'll describe the needs in hope someone can help me figure out the building blocks that need to be assembled.

We're currently running Windows 2016 Server RAS/VPN server and we have Windows, macOS and Linux clients that connect to the VPN endpoint with L2TP over IPSec. User identification uses Windows AD login/password. And machine authentication uses a shared secret.

From there, we would like to gain more control over which client machines can connect to the VPN endpoint. That is move away from using a shared secret for machine authentication.

For now, I don't know whether we can/should keep using LT2P or whether we should move to IKEv2. Because of my limited knowledge, I'm not even sure stock Windows 2016 Server RAS/VPN will allow us to restrict which client machine are allowed to connect.

Can someone please help me assemble this puzzle? Thanks!

PS: Ideally, we would like to keep using Windows 2016 Server RAS as it enables us to use stock networks settings on client machines compared to e.g. deploying OpenVPN

Edit

When I write

we would like to gain more control over which client machines can connect to the VPN endpoint

I mean we don't want people to reuse their credentials to connect personal devices to the VPN. We only want trusted / work machines to connect.

2

You can use Network Policy Server (NPS). It's a feature of Windows, you can add it to any Windows Server, Network Policy and Access Services (NPAS) feature. You can then add policies to connected clients, for example to make some checks if they are fully patched. You can continue to use Windows 2016 Server RAS of course.

I had used it effectively in the past, on Windows 2008 R2 server. We later switched to OpenVPN.

L2TP over IPSec should be ok, it's still widely used; yet IKEv2 is more modern, considered more secure and faster.

| improve this answer | |
  • Will that work with macOS and Linux clients? – Gregory Pakosz Jun 16 at 21:08
  • 1
    We were told by MS guys that third party NAP/NPS clients for Mac & Linux existed; but we didn't make any effort, didn't have such clients back then. L2TP over IPSec VPN worked fine on Mac & Linux. – Krackout Jun 17 at 8:57
1

Regarding your clarification,

we don't want people to reuse their credentials to connect personal devices to the VPN. We only want trusted / work machines to connect

You could use certificates instead of credentials to setup VPN connections on clients. The certificates can be installed non-exportable, at least on Windows client machines, so that they cannot be exported and used to personal devices. That way you can be assured that only trusted / work machines would connect.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.