Always on VPN - Device/User Tunnels

[meakjoe]

Hello all,

 

We've recently successfully set up Always on VPN, and both Machine and User tunnels are working.

 

The only part that I'm a bit unsure on is when to use Machine or User tunnels. Some guides I've read say that a Machine tunnel should be used for initial device communication and for pre login steps, and that User tunnels for accessing file shares etc.

 

Has anyone here got it setup in this way, so that the user logs in with a Machine tunnel, then establishes a User tunnel once logged in?

 

The only downside with Computer tunnels is that there's no way to lock down which users can login to the PC as once the machine is connected, it's just like being on the internal network, so we would like some way to control either which users or machines can use the VPN, with some sort of security group potentially.

 

Thanks!

[FishCustard]

Your understanding is correct - however you can just use machine tunnels if you want, with no need for individual user tunnels. However, this can be buggy (at least it was on 17xx/18xx versions of W10) and user tunnels are generally more robust.

[meakjoe]

Ok thank you. Are you aware of any way to restrict machine tunnel access with RADIUS or security groups? As I understand it, if machine has the certificate and the VPN Profile installed, they can connect. Whereas with User tunnels, RADIUS authentication with a security group allows/denys access when they attempt to connect.

[PyROm]

With machine tunnels it is the machine that is authing, you can create a vpn group, add the machines you want to connect to it, then set the condition on the nps server that the machine is in the vpn group (it wont work if you try to set user based conditions at same time). You can also set permissions on the certificate template on the certificate server to only let the vpn group enroll/auto enroll the required certificate, preventing other machines getying the certificate. User wise you can use gpo security policy to limit who can log into the pc, however it will limit them all the time, regardless if on vpn or not.

[meakjoe]

Thanks for your reply. We've got a group created to auto enroll PCs with the machine certificate as you suggest, however once they have the certificate there's nothing stopping them connecting.

 

Having a computer security group with the NPS Server as you suggest is what we'd like, however I don't think that's possible? User auth with a security group and RADIUS works perfectly but machine auth seems to work in a different way...

[PyROm]

Hi, its working here with always on VPN, I have left the default time restriction line in place (I cant remember if it was required for it to work or not). The main thing is to make sure you dont have anything user related in the nps policy, it will fail to work if so. Edited November 11, 2019 by PyROm

[meakjoe]

Interesting, so that NPS policy is for connections directly to the RRAS? On the RRAS server, do you 'Allow machine certificate authentication for IKEv2' or is it all done through EAP?

[PyROm]

Under The constraints, authentication section I have everything unchecked, with just "Microsoft: Protected EAP (PEAP)" in the list. Inside that (Edit "Microsoft: Protected EAP (PEAP)") list item I have just "Smart card or other certificate"

 

Because I have the NPS server installed on the same machine as RRAS I do not get the authentication options from rras, it sends everything to NPS.

[PyROm]

Just double checked, I do have both EAP and Allow Machine authentication for ikev2 checked in the authentication methods window (and nothing else)

[meakjoe]

Ok thank you, with your setup, if you remove the device from the Security Group, is it not allowed to connect? I can't get it working with our set up, it's not forwarding any Computer Connection requests to the NPS server over RADIUS, it only seems to do that for users. Computer connections just go straight through with the Machine Certificate.

[PyROm]

I thought I had tried it, but cant guarentee it. Stuck in hospital for a couple of weeks, connected in and working over link, so cant sabotage it to test at the moment im afraid.

[meakjoe]

Ah right no worries, thank you for your help and hope everything goes well with the hospital.