EAP-TLS-Based Remote Access VPN Connections | Deploying Virtual Private Networks with Microsoft Windows Server 2003 (Technical Reference)

EAP-TLS-based remote access VPN connections require a user certificate on the VPN client and a computer certificate on the IAS server. EAP-TLS is used when you want to authenticate your VPN connection with the most secure user-level authentication protocol. Locally installed user certificates in the following steps are used to make it easier to set up in a test lab. In a production environment, it is recommended that you use smart cards, rather than locally installed user certificates, for EAP-TLS authentication.

DC1

To configure DC1 for autoenrollment of user certificates, perform the following steps:

Click Start, click Run, type mmc, and then click OK.
On the File menu, click Add/Remove Snap-in, and then click Add.
Under Snap-in, double-click Certificate Templates, click Close, and then click OK.
In the console tree, click Certificate Templates. All the certificate templates are displayed in the details pane. This is shown in the following figure.
In the details pane, click the User template.
On the Action menu, click Duplicate Template.
In the Display Name field, type VPN Access.
Ensure that the Publish Certificate In Active Directory check box is selected. This is shown in the following figure.
Click the Security tab.
In the Group Or User Names field, click Domain Users.
In the Permissions For Domain Users list, select the Enroll and Autoenroll permission check boxes. This is shown in the following figure.
Click the Subject Name tab.
Clear the Include E-Mail Name In Subject Name and E-mail Name check boxes. Because an e-mail name was not configured for the VPNUser1 user account, leaving these options selected will prevent a user certificate from being issued. This is shown in the following figure.
Click OK.
Open the Certification Authority snap-in.
In the console tree, open Certification Authority, Example CA, and then Certificate Templates. This is shown in the following figure.
On the Action menu, point to New, and then click Certificate Template To Issue.
Click VPN Access. This is shown in the following figure.
Click OK.
Open the Active Directory Users And Computers snap-in.
In the console tree, double-click Active Directory Users And Computers, right-click the example.com domain, and then click Properties.
On the Group Policy tab, click Default Domain Policy and then click Edit.
In the console tree, open User Configuration, Windows Settings, Security Settings, and then Public Key Policies. This is shown in the following figure.
In the details pane, double-click Autoenrollment Settings.
Click Enroll Certificates Automatically. Select the Renew Expired Certificates, Update Pending Certificates, And Remove Revoked Certificates check box. Select the Update Certificates That Use Certificate Templates check box. This is shown in the following figure.
Click OK.

IAS1

To configure IAS1 with a computer certificate and for EAP-TLS authentication, perform the following steps:

To ensure that IAS1 has auto-enrolled a computer certificate, type gpupdate at a command prompt.
Open the Internet Authentication Service snap-in.
In the console tree, click Remote Access Policies.
In the details pane, double-click VPN Remote Access To Intranet. The VPN Remote Access To Intranet Properties dialog box is displayed.
Click Edit Profile, and then click the Authentication tab.
On the Authentication tab, click EAP Methods. The Select EAP Providers dialog box is displayed.
Click Add. The Add EAP dialog box is displayed.
Click Smart Card Or Other Certificate, and then click OK.
Click Edit. The Smart Card Or Other Certificate Properties dialog box is displayed. This is shown in the following figure.
The properties of the computer certificate issued to the IAS1 computer are displayed. This step verifies that IAS has an acceptable computer certificate installed to perform EAP-TLS authentication. Click OK.
Click OK to save to the selection of an EAP provider. Click OK to save changes to the profile settings.
When prompted to view help topics, click No. Click OK to save changes to the remote access policy.

These configuration changes will allow the VPN remote access to intranet remote access policy to authorize VPN connections using the EAP-TLS authentication method.

CLIENT1

To obtain a user certificate on CLIENT1 and then configure an EAP-TLS-based remote access VPN connection, perform the following steps:

Shut down CLIENT1.
Disconnect the CLIENT1 computer from the simulated Internet network segment, and connect it to the intranet network segment.
Restart the CLIENT1 computer, and log on using the VPNUser1 account. Computer and user group policy is automatically updated.
Shut down the CLIENT1 computer.
Disconnect the CLIENT1 computer from the intranet network segment, and connect it to the simulated Internet network segment.
Restart the CLIENT1 computer, and log on using the VPNUser1 account.
On CLIENT1, open the Network Connections folder from Control Panel.
In Network Tasks, click Create A New Connection.
On the Welcome To The New Connection Wizard page of the New Connection Wizard, click Next.
On the Network Connection Type page, click Connect To The Network At My Workplace.
Click Next. On the Network Connection page, click Virtual Private Network Connection.
Click Next. On the Connection Name page, type EAPTLStoCorpnet in the Company Name text box.
Click Next. On the VPN Server Selection page, type 10.0.0.2 in the Host Name Or IP Address text box.
Click Next. On the Public Network page, select Do Not Dial The Initial Connection.
Click Next. On the Connection Availability page, click Next.
On the Completing The New Connection Wizard page, click Finish. The Connect EAPTLStoCorpnet dialog box is displayed.
Click Properties, and then click the Security tab.
On the Security tab, click Advanced, and then click Settings. The Advanced Security Settings dialog box is displayed.
In the Advanced Security Settings dialog box, select Use Extensible Authentication Protocol (EAP). This is shown in the following figure.
Click Properties. On the Smart Card Or Other Certificate Properties dialog box, select Use A Certificate On This Computer. This is shown in the following figure.
Click OK to save changes to the Smart Card Or Other Certificate EAP type. Click OK to save changes to the Advanced Security Settings. Click OK to save changes to the Security tab. The connection is immediately initiated using the installed user certificate.
When the connection is complete, run the Web browser.
In the Address text box, type http://IIS1.example.com/iisstart.htm. You should see a Web page titled “Under Construction.”
Click Start, click Run, type \\IIS1\ROOT, and then click OK. You should see the contents of the Local Drive (C:) on IIS1.
Right-click the EAPTLStoCorpnet connection, and then click Disconnect.