In its default configuration, NetMotion Mobility connections are established at the user level. In most cases this level of access is sufficient, but there are some common uses cases that require VPN connectivity before the user logs on. Examples include provisioning a new device to a user who has never logged on before, or to allow support engineers to connect to a remote device without requiring a user to log in first.

Infrastructure Requirements

To support NetMotion Mobility’s “unattended mode” (device tunnel) it will be necessary to deploy a Windows Server 2016 (or 2012R2) Network Policy Server (NPS). In addition, an internal private certification authority (CA) will be required to issue certificates to the NPS server and all NetMotion Mobility client computers.

Client Certificate Requirements

A certificate with the Client Authentication Enhanced Key Usage (EKU) must be provisioned to the local computer certificate store on all NetMotion Mobility clients that require a device tunnel (figure 1). The subject name on the certificate must match the fully qualified domain name of the client computer (figure 2). It is recommended that certificate auto enrollment be used to streamline the provisioning process.

Figure 1. Computer certificate with Client Authentication EKU.

Figure 2. Computer certificate with subject name matching the client computer’s hostname.

NPS Server Certificate Requirements

A certificate with the Server Authentication EKU must be provisioned to the local computer certificate store on the NPS server (figure 3). The subject name on the certificate must match the fully qualified domain name of the NPS server (figure 4).

Figure 3. Computer certificate with Server Authentication EKU.

Figure 4. Computer certificate with subject name matching the NPS server’s hostname.

NPS Server Configuration

Next install the NPS server role by running the following PowerShell command.

Install-WindowsFeature NPAS -IncludeMamagementTools

Once complete, open the NPS server management console and perform the following steps.

Note: Below is a highly simplified NPS configuration designed for a single use case. It is provided for demonstration purposes only. The NPS server may be used by more than one network access server (NAS) so the example policies included below may not work in every deployment.

1. Expand RADIUS Clients and Servers.
2. Right-click RADIUS clients and choose New.
3. Select the option to Enable this RADIUS client.
4. Enter a friendly name.
5. Enter the IP address or hostname of the NetMotion gateway server.
6. Click Verify to validate the hostname or IP address.
7. Select Manual to enter a shared secret, or select Generate to create one automatically.
8. Copy the shared secret as it will be required when configure the NetMotion Mobility gateway server later.
9. Click OK.
   
10. Expand Policies.
11. Right-click Network Policies and choose New.
12. Enter a descriptive name for the new policy.
13. Select Type of network access server and choose Unspecified.
14. Click Next.
    
15. Click Add.
16. Select Client IPv4 Address.
17. Click Add.
18. Enter the internal IPv4 address of the NetMotion Mobility gateway server.
19. Click OK.
20. Click Next.
    
21. Select Access granted.
22. Click Next.
    
23. Click Add.
24. Choose Microsoft: Protected EAP (PEAP).
25. Click OK.
26. Select Microsoft: Protected EAP (PEAP).
27. Click Edit.
28. Choose the appropriate certificate in the Certificate issued to drop down list.
29. Select Secure password (EAP-MSCHAP v2).
30. Click Remove.
31. Click Add.
32. Choose Smart Card or other certificate.
33. Click OK.
34. Select Smart Card or other certificate.
35. Click Edit.
36. Choose the appropriate certificate in the Certificate issued to drop down list.
37. Click OK.
    
38. Uncheck all options beneath Less secure authentication methods.
39. Click Next three times.
40. Click Finish.
    

Mobility Server Configuration

Open the NetMotion Mobility management console and perform the following steps.

1. In the drop-down menu click Configure.
2. Click Authentication Settings.
3. Click New.
4. Enter a descriptive name for the new authentication profile.
5. Click OK.
6. Expand Authentication.
7. Select Mode.
8. Select Unattended Mode Authentication Setting Override.
9. From the Authentication mode drop-down box choose Unattended.
10. Click Apply.
    
11. Expand RADIUS: Device Authentication.
12. Select Servers.
13. Select [Profile Name] Authentication Setting Override.
14. Click Add.
15. Enter the IP address of the NPS server.
16. Enter the port (default is 1812).
17. Enter the shared secret.
18. Click OK.
    
19. In the drop-down menu click Configure.
20. Click Client Settings.
21. Expand Device Settings.
22. Select the device group to enable unattended mode for.
23. Expand Authentication.
24. Select Settings Profile.
25. Select [Device Group Name] Group Settings Override.
26. In the Profile drop-down menu choose the authentication profile created previously.
27. Click Apply.
    

Validation Testing

If everything is configured correctly, the NetMotion Mobility client will now indicate that the user and the device have been authenticated.

Summary

Enabling unattended mode with NetMotion Mobility provides feature parity with DirectAccess machine tunnel and Windows 10 Always On VPN device tunnel. It ensures that domain connectivity is available before the user logs on. This allows users to log on remotely without cached credentials. It also allows administrators to continue working seamlessly on a remote computer after a reboot without having a user present to log on.

Additional Resources

NetMotion Mobility as an Alternative to DirectAccess