All posts tagged Windows Server 2019

Always On VPN RRAS and Stale Connections

Always On VPN Updates for RRAS and IKEv2

Always On VPN administrators may be familiar with an issue that affects Windows Server Routing and Remote Access Service (RRAS) servers, where many stale VPN connections appear in the list of active connections. The issue is most prevalent when using IKEv2, either for the Always On VPN device tunnel or the user tunnel. Typically, this does not cause problems, but some administrators have reported issues related to port exhaustion or failed IKEv2 connections when many stale connections are present. Stale connections happen so frequently that I created a PowerShell script to clean them up on the RRAS server. Restarting the RemoteAccess service or rebooting the server also clears stale connections.

Microsoft Fix

Thankfully, Microsoft has addressed these issues in Windows Server 2019 and Windows Server 2022 this month. An update is now available in the March 2023 security update that resolves this problem.

You can find more information about the updates here.

The update was not made available for Windows Server 2016, however. Organizations are encouraged to upgrade to Windows Server 2019 or later to address this problem.

Additional Information

Always On VPN Updates for RRAS and IKEv2

Always On VPN IKEv2 Load Balancing and NAT

Always On VPN and IKEv2 Fragmentation

Leave a comment
by Richard M. Hicks on March 14, 2023  •  Permalink
Posted in Always On VPN, device tunnel, Enterprise, enterprise mobility, GitHub, Hotfix, IKEv2, Infrastructure, Microsoft, Mobility, Operational Support, PowerShell, Remote Access, routing and remote access service, RRAS, troubleshooting, Update, user tunnel, VPN, Windows Server 2019, Windows Server 2022
Tagged , , , , , , , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on March 14, 2023

https://directaccess.richardhicks.com/2023/03/14/always-on-vpn-rras-and-stale-connections/

NetMotion Mobility Is Now Absolute Secure Access

NetMotion Mobility is a premium enterprise mobility and Zero Trust Network Access (ZTNA) solution that delivers unrivaled capabilities and performance. It includes many features unavailable in any other secure remote access solution. It is software-based, running on Windows Server, and does not require dedicated or proprietary hardware. It also features broad client support, including Windows (Professional and Enterprise), macOS, iOS (iPhone and iPad), and Android phones and tablets.

Absolute Software

Last year NetMotion Software was acquired by Absolute Software, makers of persistent, self-healing security software. Beginning with release 12.70, NetMotion Mobility has been rebranded as Absolute Secure Access. In addition, NetMotion Mobile IQ, a comprehensive visibility and reporting tool that integrates with Mobility is now Absolute Insights for Network.

What’s New in 12.70

Absolute Secure Access v12.70 has been completely rebranded, and the management user interface (UI) has a new look and feel. The UI and endpoint agent also includes new icons. In addition, Absolute Secure Access 12.70 includes the following new features.

  • Formal support for Windows Server 2022
  • Enhanced data warehouse security controls
  • Faster Network Access Control (NAC) checks
  • Improved user and device authentication certificate selection – no more user prompts!
  • Support for iOS 16

Migration Path

Migrating from NetMotion Mobility 12.5x to Absolute Secure Access 12.70 is straightforward. However. Migrating from NetMotion Mobility releases before 12.5x will prove more challenging. Specifically, the 12.5x release introduced some significant architectural changes which prevent in-place upgrades to 12.70. With NetMotion Mobility releases before 12.5x, it is recommended to implement new infrastructure running 12.70 and migrate users to the new infrastructure.

Additional Information

Absolute Enterprise VPN and Zero Trust Network Access (ZTNA)

VIDEO: Introduction to Absolute Secure Access Enterprise VPN and ZTNA

What’s New in Absolute Secure Access 12.70

Absolute Secure Access Purpose-Built Enterprise VPN

Absolute Secure Access Purpose-Built Enterprise VPN Advanced Features In Depth

Leave a comment
by Richard M. Hicks on January 16, 2023  •  Permalink
Posted in Absolute, Absolute Secure Access, Absolute Software, Enterprise, enterprise mobility, Infrastructure, Mobility, NAC, NetMotion, NetMotion Mobility, NetMotion Software, Network Access Control, Remote Access, Security, VPN, Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Zero Trust, Zero Trust Network Access, ZTNA
Tagged , , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on January 16, 2023

https://directaccess.richardhicks.com/2023/01/16/netmotion-mobility-is-now-absolute-secure-access/

Always On VPN RADIUS Configuration Missing

Windows Server Routing and Remote Access Service (RRAS) is a popular choice for administrators deploying Always On VPN. It is easy to configure and scales out easily. Most commonly, RRAS servers are configured to use RADIUS authentication to provide user authentication for Always On VPN client connections. The RADIUS server can be Microsoft Network Policy and Access Server (NPAS, or simply NPS) or a third-party RADIUS solution. It is best to have the RADIUS service running on a server separate from the RRAS server.

RADIUS Authentication

Administrators can configure RADIUS authentication by opening the Routing and Remote Access management console (rrasmgmt.msc), right-clicking the VPN server, then choosing Properties > Security. Click the Configure button to configure authentication and accounting providers accordingly.

RADIUS Options Missing

In some cases, the administrator will notice that the option to configure RADIUS authentication and accounting servers is missing. In its place is the following error message.

“Because Network Policy Server (NPS) is installed, you must use it to configure authentication and accounting providers. To configure authentication and accounting providers, create or modify connection request policies.”

Configuration Options

It might be tempting for administrators to follow this guidance when presented with this message by opening the Network Policy management console (nps.msc) to configure it. However, that is not recommended or necessary. This message results from a common configuration error that should be corrected.

NPS Role Installed

The error message above occurs when an administrator mistakenly installs the NPAS role on the RRAS server itself. Again, this is not recommended or required. To resolve this issue, uninstall the NPS role by opening an elevated PowerShell command window and running the following command.

Uninstall-WindowsFeature NPAS

Configuration Corrupted

After removing the NPAS role from the RRAS server, administrators may encounter the following error message when configuring RADIUS authentication and accounting servers in RRAS.

“The connection request policy used for authentication and accounting configuration is corrupted. Either install Network Policy Server (NPS) and restore the connection request policy manually, or click Repair Settings to restore the connection request policy by using Windows Accounting and Windows Authentication.”

Repair Settings

To resolve this issue, click the Repair Settings button. Once complete, RADIUS authentication and accounting configuration should work as expected.

Additional Information

Always On VPN Network Policy Server (NPS) Auditing and Logging

Always On VPN Network Policy Server (NPS) Load Balancing

Always On VPN and Windows Server 2019 Network Policy Server (NPS) Bug

1 Comment
by Richard M. Hicks on October 13, 2022  •  Permalink
Posted in Always On VPN, AOVPN, authentication, Enterprise, enterprise mobility, Mobility, network policy server, NPS, Operational Support, Remote Access, routing and remote access service, RRAS, Security, troubleshooting, user tunnel, VPN, Windows 10, Windows 11, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022
Tagged , , , , , , , , , , , , , , , , , , , , , , , , ,

Posted by Richard M. Hicks on October 13, 2022

https://directaccess.richardhicks.com/2022/10/13/always-on-vpn-radius-configuration-missing/

« Older Posts
%d bloggers like this: