Domain Laptop - always on VPN

[mdrabble]

In my mind I am thinking a domain laptop can connect back to the domain via any internet connect and via Always on VPN, so they have access to network drives, SIMS, etc......

 

Is this correct or am I only wishful thinking?

 

If it is a correct - anyone got any info on how to set this up from scratch

 

Cheers

[ITGURU]

In my mind I am thinking a domain laptop can connect back to the domain via any internet connect and via Always on VPN, so they have access to network drives, SIMS, etc......

 

Is this correct or am I only wishful thinking?

 

If it is a correct - anyone got any info on how to set this up from scratch

 

Cheers

It can definitely been done - i've seen it on other schools laptops, they login to the laptop and have direct access to SIMS, network drives etc.

However, i've never set it up, we just provide remote access to SIMS,network drives, office etc using RemoteApp.

[jtotheb]

In my mind I am thinking a domain laptop can connect back to the domain via any internet connect and via Always on VPN, so they have access to network drives, SIMS, etc......

 

You're correct, but it's a fair bit of work.

The Microsoft guide is pretty good for the basics https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/ with Richard Hicks' blog a welcome resource for ironing out the kinks https://directaccess.richardhicks.com/

[markwilfan]

Always on VPN setup at my place. Been using it for ages. Awesome and no need for ipv6 nonsense

[fredbayker]

If somebody gained unauthorised access to the laptop, do they have access to the domain?

[mavhc]

Access to the laptop? The storage drive? The user's password?

 

Main restrictions seem to be lack of GPO config support, and Device level VPN needing Edu/Ent version.

 

"Always On VPN supports traffic filtering, allowing administrators to restrict remote client communication by IP address, protocol, port, or application"

 

"Any firewall or VPN device can be used for Always On VPN as long as they support the Internet Key Exchange version 2 (IKEv2) VPN protocol for remote access connections. Most modern firewalls today support IKEv2, but some (such as the Sophos XG firewall) do not. Check with your vendor to validate support.

 

If the firewall or VPN device supports IKEv2 for remote access connections, the native Windows VPN provider can be used to establish an Always On VPN connection. The native provider is used when the Always On VPN ProfileXML is configured using the NativeProfile element."

Edited November 15, 2019 by mavhc

[mrcrazy04]

I've used the Always On VPN and it works quite well, although you can end up with some split tunnelling (where some traffic doesn't go via the VPN) - which can be useful for logging in to public WiFi, but isn't great if you want all traffic to go through your web filter.

 

I've found Richard Hicks' website to be very useful for configuring Always on VPN (although I think there were a couple of areas that I had to puzzle through on my own). NCSC have released some PowerShell scripts to help configure things on the clients, which should also be of assistance - https://s3.eu-west-2.amazonaws.com/eud-security-guidance/NCSC+Remote+Access+Scripts+Version+3.4.zip (linked from https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/eud-security-guidance-windows-10-1809).

The DeviceTunnel means the device will bring up a VPN connection before users login, so it can pull GPO updates and so on when remote - I've found it can sometimes take a while to bring up the DeviceTunnel though, and transitioning to the UserTunnel when a user logs in can also take a little while.

 

In terms of setting it up from scratch, you'll need to have a VPN server (I've used StrongSwan on Linux as it supports the most things, but has a very steep learning curve to get everything up and running). You'll then need to create a client certificate for each device that connects, signed by an internal CA (if you have one already, you could use that), and configure your VPN server to allow connections from clients with certificates signed by that CA. Using a separate certificate per device means that if a certificate is compromised, you can just revoke it without having to re-provision all your devices.

I've only done fairly small-scale deployments, so haven't needed to automate pushing the certificates to devices - has anybody got an easy way of doing that?

 

If you're worried about the VPN certificate being compromised, following good security practice in terms of the laptop build (so BitLocker, AppLocker, locking after a period of inactivity, and not giving users admin access) should help reduce the risk of that. If you want to be extra paranoid, you could implement NCSC's walled garden, but I'm guessing that won't give you access to the various domain resources that you'd like.

[jtotheb]

I've only done fairly small-scale deployments, so haven't needed to automate pushing the certificates to devices - has anybody got an easy way of doing that?

 

Group Policy can sort out client certificate enrolment before they go off site. Never had to do it for devices already out in the field.