Technical Overview: Always On VPN

Transcription

1 Technical Overview: Always On VPN

2 Introduction Always On VPN (AOVPN) offers a single, unified remote access solution and supports domain-joined, nondomain-joined (workgroup). AOVPN provided always on connectivity on a stable Internet connection transparent to the end user. AOVPN provides two types of VPN profiles on a window 10 AOVPN supported device, Device Tunnel and User Tunnel. Device Tunnel: Enables Windows 10 AOVPN enable device to connect with specified VPN servers prior to users log on to the device. Organizations require remote device management and Pre-login connectivity scenarios use device tunnel connectivity options. AOVPN Device Tunnel can be compared with DirectAccess Infrastructure tunnel. User Tunnel: Enables windows 10 AOVPN enabled device to connect only after a user has successfully logged on to the device. After User tunnel connected with the specified VPN severs, it allows users to access organization corporate resources through VPN servers. Device and User tunnels can work independently with their configured VPN profiles, can be configured to use different authentication methods, can be connected at the simultaneously, and can use appropriate VPN configuration settings. Networking DirectAccess connectivity depends on IPv6, whereas AOVPN doesn t depend on IPv6 or IPv4 protocol and natively supports the use of IPv4 and IPv6 routing policies. AOVPN Authentication AOVPN provide native support for EAP (Extensible Authentication Protocol), enabling administrators to use diverse Microsoft and third party EAP types for authentication. EAP provides the following authentication combination types: Active Directory based Username and password User or Machine certificate Smart card using physical or virtual One-time password of MFA support by utilizing EAP Radius integration Windows Hello for Business When Always On VPN configured device is outside of the corporate network and has an active Internet connection, the device will attempt to establish connectivity with the AOVPN gateway by creating IPsec security associations defined by the VPN configuration on VPN server and Windows 10 client. In a typical configuration, IPSecMainMode and IPSecQuickModeSA Security associations are created following successful AOVPN connection between VPN client and VPN gateway. Always on VPN Application triggering Name-based Triggering Trusted Network detection

3 AOVPN Network Configuration AOVPN in Windows Server 2012 R2 /2016 can now be configured behind an existing edge firewall for additional protection. Using this deployment model, the AOVPN server is configured using IPv4 addresses. The server can be configured with two network interfaces in parallel with existing perimeter networks, or with a single network interface either in the DMZ or on the LAN. Perimeter/DMZ deployments reduce the exposure of the AOVPN server to untrusted networks. This improves security. When the AOVPN server is located behind a device performing NAT, it supports NAT- T (NAT Traversal) protocol allow VPN client to make a successful VPN tunnel type Ikev2 over UDP 500 and 4500 ports. Comparison: DirectAccess Vs Always ON VPN DirectAccess Functionality 1 Transparent connectivity to corporate network Managing remotely connected DA clients via Manage-out from management workstations Dedicated Tunnel (Infrastructure) to provide corporate access prior to user login Use of Network Location service (NLS) to determine the inside / outside corporate location HTTPS Connectivity DirectAccess operational status monitoring DirectAccess connected clients operational status Inbox or Radius accounting for DA connections reporting Enable Access to Management servers prior to user login Load balancing support using Windows NLB or third-party load balancer DirectAccess security groups to limit remote access functionality to specific domain joined devices AOVPN equivalent Always on VPN can be used to support; application launch based auto-triggering, namespace resolution requests or permanent Always ON VPN Device Tunnel can be configured to achieve this functionality Device Tunnel can be configured to achieve this functionality Trusted Network detection can be used to achieve the similar compatibility, which is based on connection specific DNS suffix assigned to NIC SSTP can be used as fall-back option from IKEv22 the operational status of VPN services the operational status of AOVPN clients the reporting for AOVPN clients Device Tunnel with traffic filters can be configured to achieve similar functionality AOVPN support the use of Windows NLB and thirdparty load balancer for load balancing SSTP and IKEv2 tunnel types RADIUS can be used to configure granular authorisation access by the way of security groups in User Tunnel type

4 DirectAccess support behind edge firewall or NAT device Multiple domains and forest support Split tunnel and force tunnel support for intranet/internet separation Use of Network Connectivity assistant (NCA) to provide corporate connectivity status DirectAccess Multisite to provide multiple remote access entry points DirectAccess client configuration via Group Policy AOVPN can be configured to use protocols IKev2 or SSTP which fully support the use of VPN server behind NAT device or perimeter firewall AOVPN doesn t depend on AD domain services forests and domain topology. AD authorisation can be achieved via RADIUS by way of EAP. AOVPN can be used to configure Split and force tunnel natively with additional application specific granular routing policies AOVPN is integrated with native NCA and offers connectivity status from NIC AOVPN doesn t offer this feature natively, however this functionality can be achieved by way of third-party global server load balancing (GSLB) AOVPN configuration can be applied using PowerShell, SCCM, Intune3 1 source: 2 Device Tunnel only configurable using windows built-in VPN and requires use of IKEv2 tunnel type using computer certificate authentication. 3 not all tunnel types support all client setting deployment options About Celestix Networks: For over a decade, Celestix has developed innovative security solutions enabling organizations to leverage leading and emerging technologies. Founded in 1999, Celestix Networks has delivered solutions to thousands of corporate and government organizations worldwide. Celestix is headquartered in Fremont, California with offices in Singapore; Reading, UK and Tokyo, Japan. Copyright information 2018 Celestix Networks, Inc. All rights reserved. This document is provided as-is. Information and views expressed in this document, including URL and other website references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Micros

5 Corporate Headquarters Celestix Networks, Inc. 215 Fourier Ave #140 Fremont, California EMEA Headquarters 95 London Street Reading RG1 4QA United Kingdom +44 (0) Asia Pacific Headquarters 62 Ubi Road 1 #04-07 Oxely Bizhub 2 Singapore Celestix Networks, Japan Hirakawa-Cho Chiyoda-ku Tokyo, Japan