maxrebo Posted October 22, 2020 Posted October 22, 2020 Hi, We currently use Windows 2012 R2 RD Web access, I'm in two minds whether to update our RD Web access to 2016/19 or move over to a Always on VPN setup for Remote access. Looking for a bit of advice on this one. Thanks
synaesthesia Posted October 22, 2020 Posted October 22, 2020 After shifting to AOVPN here I can firmly say it's a game changer, do it! It can be a little bit fiddly but it's very much worth it - we've had so many positive comments from staff who just take their laptops home and things work identically to in school plus added extras like sending stuff to a follow me print queue to pick up in the morning - compared to doing SIMS via remoteapp, home access plus, onedrive etc etc it's so much easier. 1
Jcx500 Posted October 22, 2020 Posted October 22, 2020 we upgraded to rdweb on 2016 and always on vpn, rdweb is useful for staff who don't have laptops, but all staff laptops are on the vpn 1
psydii Posted October 22, 2020 Posted October 22, 2020 I'm interested to hear how you configure and deploy the AOVPN settings to your laptops.
CHiLL Posted October 22, 2020 Posted October 22, 2020 Similar to @synaesthesia for us. AOVPN has made working from home a much better experience and I'm extremely glad that I implemented it as a side project last year, because it's made working from home during lockdown a much easier experience. My main gripes with it is that the VPN connection will just stop working and get stuck on "Connecting...", or it will remove itself completely from a user's account, or the user certificate will randomly remove itself from the user's account. I'm pushing the VPN profile via a PowerShell script and configuration XML via SCCM. Because of this, I can't reinstall it without the device being connected to our domain, as Software Centre won't load with a connection to SCCM and the certificates are installed automatically by the domain.
kmount Posted October 22, 2020 Posted October 22, 2020 After shifting to AOVPN here I can firmly say it's a game changer, do it! It can be a little bit fiddly but it's very much worth it - we've had so many positive comments from staff who just take their laptops home and things work identically to in school plus added extras like sending stuff to a follow me print queue to pick up in the morning - compared to doing SIMS via remoteapp, home access plus, onedrive etc etc it's so much easier. Lo, Long time no speak hope you're well. Does SIMs work reasonably over it these days with updates etc? Do you just have an 'always online' approach with their laptops or known folder redirection to one drive and sync/cache etc incase offline? Cheers Would be interested in hearing how you're approaching it there.
Boredguy Posted October 22, 2020 Posted October 22, 2020 I've recently setup AoVPN and so far the tests were very successful, but we did have to tweak the XML file as we wanted forced tunnel on to ensure all web traffic from devices goes though our filtering (since its mainly going to be students using it), but as the device could be seen via Impero over the VPN, there is nothing stopping SIMS from functioning
Boredguy Posted October 22, 2020 Posted October 22, 2020 I'm interested to hear how you configure and deploy the AOVPN settings to your laptops. I just followed the steps in https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always-on-vpn-deploy-deployment and other than a lot of cursing as our VPN server was not giving out DHCP addresses at first (turns out it had a dodgy registry entry) the guide was quite straight forward for a change. 4
3s-gtech Posted October 22, 2020 Posted October 22, 2020 I’ve tried to deploy it, but stuck waiting for external IP and DNS to be done. I’m 99% sure I’ve cocked it up though. Didn’t use RADIUS for a start.
Boredguy Posted October 22, 2020 Posted October 22, 2020 To be honest, the most complex part I found in the guide was actually getting the certificate templates setup in our CA as you need to make sure it's done correctly. That and I hadn't noticed that when I setup our new Remote Desktop servers with Windows 2019 recently it had added a deny rule for VPN to our NPS server so everytime I connected it was saying the username and password was incorrect. Guess that's what happens when you use one that also does Remote Desktop access and WiFi authentication for different SSIDs. lots of rules means it's easy to over look one
mbedford Posted October 22, 2020 Posted October 22, 2020 We use both, RDP for out students\staff who don't have a domain laptop and Direct Access (Microsoft) for domain joined laptops. DA, was a pain to setup but after that, its a breeze. We have about 100 people offsite and barely get any calls about accessing the network remotely. 1
synaesthesia Posted October 23, 2020 Posted October 23, 2020 Honestly it's worth the hassle We did need to tweak some of the XML as a lot of the examples didn't copy & paste over correctly. Deployment is SCCM for the user tunnel and Intune (well Endpoint Manager) for the device tunnel as we didn't find the logon scripts reliable enough. Hi @kmount We're just on a straight always-on, so as soon as they get home to connect to their wifi it behaves identically to in school - device tunnel allows the authentication to take place then once logged in user tunnel takes over to correctly handle the user side of things. Everything works from home as it would in school and SIMS certainly works very well over it. Well, no worse than it does in school
mdrabble Posted October 23, 2020 Posted October 23, 2020 Numpty question as it is early..... Planning on installing this either today or next week - and will stick AOVPN clients on their own VLAN... so my question is, do I put then on a VLAN direct on the LAN with Windows DHCP or on a VLAN held on Smoothwall with Smoothwall handing our DCHP (Similar to BYOD) to keep them separate and where I can control ports etc? Or does it not matter? Using Windows NPS to dynamically assign VLAN for BYOD devices
synaesthesia Posted October 23, 2020 Posted October 23, 2020 We have a separate vlan for externally connected clients anyway just to keep things separate and let RRAS dish out the IPs rather than the dhcp server. In testing, we found doing it via the internal DHCP server caused a little fuss when laptops were going home & coming back as DNS sometimes wouldn't update quick enough, so resources were not available until machines were restarted, defeating the point if the staff member had set up a lesson, brought it in and had it ready to go. Using RRAS in that manner entirely overcomes that as it never really touches DNS, although I imagine with some tweaking to settings that could be fixable. 1
mdrabble Posted October 23, 2020 Posted October 23, 2020 Ah that makes sense.... will let RRAS dish out the IP Addresses then.
mdrabble Posted November 3, 2020 Posted November 3, 2020 When people have installed AOVPN - have you installed NPS on the same VM as the VPN role or kept the roles separate? Cheers
Boredguy Posted November 3, 2020 Posted November 3, 2020 I have the VPN and NPS role on different servers. If you do have the NPS on the same one, it complained in the RRAS that you could only setup the authorisation rules via the NPS which was a pain.. but as we already had a NPS for our Wifi authentication it made sense to just use it for the AoVPN and our Remote Desktop authentication 1
synaesthesia Posted November 3, 2020 Posted November 3, 2020 Separate here, again as we have our NPS set up for wifi anyway and prefer to keep all remote access gubbins separate from any other server so it's easily isolated in case of issue. 1
MS2011 Posted November 3, 2020 Posted November 3, 2020 We use both, RDP for out students\staff who don't have a domain laptop and Direct Access (Microsoft) for domain joined laptops. DA, was a pain to setup but after that, its a breeze. We have about 100 people offsite and barely get any calls about accessing the network remotely. Did you followed any step by step guide to setup DA? It is pain to setup when I tried last.
mdrabble Posted November 3, 2020 Posted November 3, 2020 I installed both roles on same VM as thought it would be easier and noticed it complained. I do already have NPS running radius for WiFi so will use that one for the VPN stuff as well. 1
leegcvcc Posted November 3, 2020 Posted November 3, 2020 Having a look at this, would anyone recommend using Windows Server VPN offerings/solutions as opposed to using Smoothwalls SSL VPN solution even if they have Smoothwall UTM? Great thread btw!
Jcx500 Posted November 4, 2020 Posted November 4, 2020 Having a look at this, would anyone recommend using Windows Server VPN offerings/solutions as opposed to using Smoothwalls SSL VPN solution even if they have Smoothwall UTM? Great thread btw! The Windows one works great and it simple to setup and secure via radius and you can run it on a fairly small VM ours has 3gb of ram, but it’s all down to how you want to set it up. Can’t comment on smoothwalls as I’ve never used that feature of the system
mdrabble Posted November 4, 2020 Posted November 4, 2020 After a bit a smack around the head in terms of - do it like this and not like that setup! Taken me 2 days to work through the MS Documentation due to constant interruptions and trying to workout where I left off etc..... Anyway..... network is VLAN'd - main devices on the LAN and BYOD on Smoothwall via NPS server. Do the IP addresses the VPN server hands out need to be on a VLAN? If so - on the LAN or on Smoothwall? or can they be a totally random set of IP Addresses unrelated to the network?? Will be looking to do device tunnel at somepoint so laptops offsite have same access as per onsite devices. Cheers
Boredguy Posted November 4, 2020 Posted November 4, 2020 After a bit a smack around the head in terms of - do it like this and not like that setup! Taken me 2 days to work through the MS Documentation due to constant interruptions and trying to workout where I left off etc..... Anyway..... network is VLAN'd - main devices on the LAN and BYOD on Smoothwall via NPS server. Do the IP addresses the VPN server hands out need to be on a VLAN? If so - on the LAN or on Smoothwall? or can they be a totally random set of IP Addresses unrelated to the network?? Will be looking to do device tunnel at somepoint so laptops offsite have same access as per onsite devices. Cheers You can choose in RRAS if you want to assign IP addresses from a DHCP server or from a static set you assign the server. As the point of the AoVPN is it connects in to your main network, the internal network card on your VPN box should be on the same vLan as your stations are on normally. I also went to the fun of ensuring the VPN XML file is set to forcetunnel instead of the splittunnel so that all web browsing done by users is routed via our school connection and not their own ISP gateway so that content will be filtered 1
MS2011 Posted November 4, 2020 Posted November 4, 2020 I installed both roles on same VM as thought it would be easier and noticed it complained. I do already have NPS running radius for WiFi so will use that one for the VPN stuff as well. Did you have any step by step guide or url link to follow?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now