Always On VPN - Concurrent Connections

[Norphy]

I've just set up Always On VPN because of the fun we're having with schools closing etc. I'm looking at monitoring connections and I've found the Get-RemoteAccessConnectionStatisticsSummary PowerShell cmdlet. The output of it is as follows

 

TotalConnections           : 5
TotalDAConnections         : 0
TotalVpnConnections        : 5
TotalUniqueUsers           : 
MaxConcurrentConnections   : 6
TotalCumulativeConnections : 73
TotalBytesIn               : 940063605
TotalBytesOut              : 6420033923
TotalBytesInOut            : 7360097528

 

The thing that's caught my notice is MaxConcurrentConnections : 6

 

Is that a limit of six concurrent connections or does that mean that 6 concurrent connections is the most it's seen so far?

[FishCustard]

Almost certain that's the maximum it's seen so far. Ours is 17(!) so 6 isn't some default limit.

[Norphy]

I think you're right, mine has gone up to the heady heights of 7 now.

 

Thanks

[Squelch]

My DirectAccess server had 20 concurrent connections today. Glad I don't use it to remote in.

[MatthewL]

In Direct Access when you go into the page to change settings it lists the figures on there, not sure if its the same on AO.

 

As I logged out we still had 300 users connected.

[Squelch]

That knocks my measly 20 connections into a cocked hat

[Norphy]

We're up to 13 now. Will be interested to see what it is in the morning...

[smithson83]

We had just under 100 connections to our Direct Access server first thing yesterday morning, and it averaged around 60 most of the day.

 

All our staff are expected to be available during the morning to help support the kids doing work at home.

[AJWhite1970]

We peaked at 103 on Friday morning, Monday was a much more civil 84....

 

Currently dealing with the numpties/teachers who login and then open a web page or three, Insight, SIMS and their email, none of which needs access to the Remote Desktop...

[Chuckster]

Hi guys,

 

what guide did you follow to set up Always on VPN?

[CHiLL]

I've just checked and I have a measly 10 concurrent connections at the moment. I suspect most staff are just treating this as time off at the moment because it's still fresh. Maybe in a couple of weeks I'll see more connections when staff are bored out of their minds.

 

Hi guys,

 

what guide did you follow to set up Always on VPN?

I think I mainly followed the 4SysOps one. Coupled with Microsoft#'s official documentation, as well as one from Richard Hicks.

 

My VPN is configured to use certificates and user credentials for authentication. That means the user's machine being used to connect the VPN must be domain joined, in order to have the certificate installed, the VPN profile must be installed and the user must have logged into the device at least once whilst connected to the domain, so a cached profile exists. That way, when off site, they log in with their domain credentials, which initially logs them into their cached profile and the VPN profile will automatically connect as it knows it's not on the corporate network. The VPN connection authenticates using the installed certificate and user credentials (which are obtained silently as the user is already logged in).

 

I hope that makes sense. I don't know if there are other authentication methods for the Always-On VPN, but the certificate route seems to be what was used in the guides I followed.

Edited March 24, 2020 by CHiLL

[MatthewL]

Highest I've seen today was 700 or there about's. We use split tunnelling so odd random sites that go through our other connection have had to be added to it plus a local authority decided to change the VPN between us and them stopping a key system working! Joys.

[2097]

Does any one here use OPENVPN ?

 

I currently have installed PFSENSE used only for an openVPN server , i have both certificate and LDAP authentication .

 

Once they remote in , they can use remote desktop straight into their machines .

 

We only have this available for Management .

 

For every one else its currently an aging terminal server , My plan is to build 3 Physical Remote desktop servers ( 2019 ) and use the broker,gateway on a VM etc to increase capacity.

[mrcrazy04]

I found the Richard Hicks guide to be really useful. If you use a device tunnel, then any user should be able to login to a domain joined device (if you go with certificates alone).

 

It’s worth noting that DirectAccess is somewhat deprecated (although not unsupported), so Always on VPN is the preferred option.

 

NCSC has some guidance on the use of VPNs at https://www.ncsc.gov.uk/collection/end-user-device-security/eud-overview/vpns

NCSC advise the use of IPSec over TLS VPNs; but I’ve found OpenVPN to be very useful, and quite versatile for remote access [emoji846]