I quite don't know where to start so I'll describe the needs in hope someone can help me figure out the building blocks that need to be assembled.
We're currently running Windows 2016 Server RAS/VPN server and we have Windows, macOS and Linux clients that connect to the VPN endpoint with L2TP over IPSec. User identification uses Windows AD login/password. And machine authentication uses a shared secret.
From there, we would like to gain more control over which client machines can connect to the VPN endpoint. That is move away from using a shared secret for machine authentication.
For now, I don't know whether we can/should keep using LT2P or whether we should move to IKEv2. Because of my limited knowledge, I'm not even sure stock Windows 2016 Server RAS/VPN will allow us to restrict which client machine are allowed to connect.
Can someone please help me assemble this puzzle? Thanks!
PS: Ideally, we would like to keep using Windows 2016 Server RAS as it enables us to use stock networks settings on client machines compared to e.g. deploying OpenVPN
When I write
we would like to gain more control over which client machines can connect to the VPN endpoint
I mean we don't want people to reuse their credentials to connect personal devices to the VPN. We only want trusted / work machines to connect.