Always On VPN Mini Course

Windows 10 Always On VPN Hands-On Training Classes for 2018

On Wednesday, February 9, from 9:00 AM to 10:30 AM CST, I will be delivering a 90-minute mini-course on Always On VPN infrastructure requirements and deployment options as part of the ViaMonstra Online Academy training series. The Always On VPN mini-course is a free training session and is open to everyone. Be sure to register even if you can’t join in person. A session recording will be available to all registrants after the broadcast.

Course Outline

The live online training course will include but is not limited to the following topics.

  • Always On VPN infrastructure requirements
  • On-premises and cloud-based deployment options
  • Implementation and security best practices
  • Avoiding common mistakes when deploying Always On VPN
  • Provisioning and managing Always On VPN profiles using Microsoft Endpoint Manager/Intune
  • Understanding current limitations and workarounds

Register Today

There will also be plenty of time for questions and answers. Register now, and don’t miss out on this opportunity to learn about Always On VPN!

Additional Information

Mini-Course – Always On VPN: Infrastructure Requirements and Deployment Options in Depth

Always On VPN IKEv2 Security Vulnerabilities – January 2022

The January 2022 security updates for Microsoft Windows include several important updates that will affect Always On VPN deployments. Specifically, CVE-2022-21849 addresses a Remote Code Execution (RCE) vulnerability that should be addressed immediately. The January 2022 security update also includes updates for several IKE Denial-of-Service (DoS) vulnerabilities, in addition to privilege escalation vulnerabilities in the Remote Access Connection Manager.

Update – January 17, 2022: Microsoft has released out-of-band updates to address the issues with IPsec (IKEv2 and L2TP) when using non-Microsoft VPN devices. Updates can be found here.

Update – January 13, 2022: There have been numerous reports of this update breaking VPN functionality when using non-Microsoft VPN devices. If you are using Windows Server and RRAS you can safely update. If you are using a third-party device, you may encounter problems. In addition, there have been reports of issues with domain controllers and Hyper-V servers after installing this update. Please proceed carefully and be sure to have a backup before updating!

Vulnerable Systems

These vulnerabilities are present on both Windows Server and Client operating systems. Essentially, any Windows server or client using IPsec is vulnerable and potentially exploitable.

Vulnerabilities

The following is a list of security updates related to Always On VPN deployments.

Windows IKE Extension Remote Code Execution (RCE) Vulnerability

Windows IKE Extension Denial of Service Vulnerabilities

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Additional Information

A list of all fixes in the January 2022 security update, along with links to the updates themselves, can be found here.

Always On VPN and TLS 1.3

Secure Socket Tunneling Protocol (SSTP) is a Microsoft-proprietary VPN protocol with several advantages over Internet Key Exchange version 2 (IKEv2) for Always On VPN user tunnel connections. SSTP uses HTTP with Transport Layer Security (TLS) to encrypt communication between the Always On VPN client and the VPN gateway. SSTP is very firewall-friendly, with VPN connections operating on the commonly open TCP port 443, resulting in more consistent VPN availability. SSTP throughput is better compared to IKEv2 as well.

Learn more about TLS with Practical TLS, a comprehensive online video training course.

TLS and Windows Server

For versions of Windows Server before Windows Server 2022, the out-of-the-box security for TLS is not ideal. TLS is notoriously complex to configure, with myriad options for administrators to choose from. However, with the release of Windows Server 2022 and Windows 11, Microsoft has introduced support for the latest TLS specification, TLS 1.3, which eases much of this configuration pain.

TLS 1.3

TLS 1.3 provides significant advantages for Always On VPN SSTP user tunnel connections in security and performance.

Security

TLS 1.3 is greatly simplified and offers only five cipher suites, all considered secure by today’s standards. In addition, all TLS 1.3 ciphers support forward secrecy, ensuring the privacy of communication even in the event of a server private key compromise.

Performance

The TLS handshake in TLS 1.3 is streamlined and requires less back-and-forth (round trips) to establish a connection. TLS 1.3 speeds connection establishment for new Always On VPN user tunnel connections.

Caveat

Adding support for TLS 1.3 on the server-side is a compelling reason to consider upgrading existing Windows Server Routing and Remote Access Service (RRAS) servers to Windows Server 2022. However, TLS 1.3 support for SSTP also requires Windows 11 on the client-side. TLS 1.3 is not currently supported in Windows 10.

Summary

Realizing the performance benefits provided by TLS 1.3 will likely only occur in large environments supporting many thousands of concurrent connections per server. However, the security benefits apply to all deployments, regardless of size. Administrators should consider upgrading to Windows Server 2022 before proceeding with Windows 11 adoption.

Additional Information

Practical TLS: A Deep Dive into SSL and TLS Online Video Training Course

Always On VPN SSTP Security Configuration

Always On VPN SSTP with Let’s Encrypt Certificates

Always On VPN TLS Certificate Requirements for SSTP

TLS Protocol Version Support in Windows

TLS Cipher Suites in Windows Server 2022

A Detailed Look at TLS 1.3

TLS Cipher Suite Reference

RFC8446 TLS 1.3

%d bloggers like this: