mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 14:23:38 +00:00
restart re-org
This commit is contained in:
Justin Hall
@ -0,0 +1,95 @@
|
||||
---
|
||||
title: How to use single sign on (SSO) over VPN and Wi-Fi connections (Windows 10)
|
||||
description: Explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: justinha
|
||||
ms.date: 04/19/2017
|
||||
---
|
||||
|
||||
# How to use single sign on (SSO) over VPN and Wi-Fi connections
|
||||
|
||||
This topic explains requirements to enable Single Sign-On (SSO) to on-premises domain resources over WiFi or VPN connections. The scenario is:
|
||||
|
||||
- You connect to a network using Wi-Fi or VPN.
|
||||
- You want to use the credentials that you use for the WiFi or VPN authentication to also authenticate requests to access a domain resource you are connecting to, without being prompted for your domain credentials separately.
|
||||
|
||||
For example, you want to connect to a corporate network and access an internal website that requires Windows integrated authentication.
|
||||
|
||||
At a high level, the way this works is that the credentials that are used for the connection authentication are put in Credential Manager as the default credentials for the logon session.
|
||||
Credential Manager is a place where credentials in the OS are can be stored for specific domain resources based on the targetname of the resource.
|
||||
For VPN, the VPN stack saves its credential as the session default.
|
||||
For WiFi, EAP does it.
|
||||
|
||||
The credentials are put in Credential Manager as a "\*Session" credential.
|
||||
A "\*Session" credential implies that it is valid for the current user session.
|
||||
The credentials are also cleaned up when the WiFi or VPN connection is disconnected.
|
||||
|
||||
When the user tries to access a domain resource, using Edge for example, Edge has the right Enterprise Authentication capability so [WinInet](https://msdn.microsoft.com/library/windows/desktop/aa385483.aspx) can release the credentials that it gets from the Credential Manager to the SSP that is requesting it.
|
||||
For more information about the Enterprise Authentication capability, see [App capability declarations](https://msdn.microsoft.com/windows/uwp/packaging/app-capability-declarations).
|
||||
|
||||
The local security authority will look at the device application, such as a Universal Windows Platform (UWP) application, to see if it has the right capability.
|
||||
If the app is not UWP, it does not matter.
|
||||
But if it is a UWP app, it will look at the device capability for Enterprise Authentication.
|
||||
If it does have that capability and if the resource that you are trying to access is in the Intranet zone in the Internet Options (ZoneMap), then the credential will be released.
|
||||
This behavior helps prevent credentials from being misused by untrusted third parties.
|
||||
|
||||
## Intranet zone
|
||||
|
||||
For the Intranet zone, by default it only allows single-label names, such as Http://finance.
|
||||
If the resource that needs to be accessed has multiple domain labels, then the workaround is to use the [Registry CSP](https://msdn.microsoft.com/library/windows/hardware/dn904964.aspx).
|
||||
|
||||
### Setting the ZoneMap
|
||||
|
||||
The ZoneMap is controlled using a registry that can be set through MDM.
|
||||
By default, single-label names such as http://finance are already in the intranet zone.
|
||||
For multi-label names, such as http://finance.net, the ZoneMap needs to be updated.
|
||||
|
||||
## MDM Policy
|
||||
|
||||
OMA URI example:
|
||||
|
||||
./Vendor/MSFT/Registry/HKU/S-1-5-21-2702878673-795188819-444038987-2781/Software/Microsoft/Windows/CurrentVersion/Internet%20Settings/ZoneMap/Domains/`<domain name>`/* as an Integer Value of 1 for each of the domains that you want to SSO into from your device. This adds the specified domains to the Intranet Zone of the Edge browser.
|
||||
|
||||
## Credential requirements
|
||||
|
||||
For VPN, the following types of credentials will be added to credential manager after authentication:
|
||||
|
||||
- Username and password
|
||||
- Certificate-based authentication:
|
||||
- TPM KSP Certificate
|
||||
- Software KSP Certificates
|
||||
- Smart Card Certificate
|
||||
- Windows Hello for Business Certificate
|
||||
|
||||
The username should also include a domain that can be reached over the connection (VPN or WiFi).
|
||||
|
||||
## User certificate templates
|
||||
|
||||
If the credentials are certificate-based, then the elements in the following table need to be configured for the certificate templates to ensure they can also be used for Kerberos client authentication.
|
||||
|
||||
| Template element | Configuration |
|
||||
|------------------|---------------|
|
||||
| SubjectName | The user’s distinguished name (DN) where the domain components of the distinguished name reflects the internal DNS namespace when the SubjectAlternativeName does not have the fully qualified UPN required to find the domain controller. </br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located. |
|
||||
| SubjectAlternativeName | The user’s fully qualified UPN where a domain name component of the user’s UPN matches the organizations internal domain’s DNS namespace.</br>This requirement is particularly relevant in multi-forest environments as it ensures a domain controller can be located when the SubjectName does not have the DN required to find the domain controller. |
|
||||
| Key Storage Provider (KSP) | If the device is joined to Azure AD, a discrete SSO certificate is used. |
|
||||
| EnhancedKeyUsage | One or more of the following EKUs is required: </br>- Client Authentication (for the VPN) </br>- EAP Filtering OID (for Windows Hello for Business)</br>- SmartCardLogon (for Azure AD joined devices)</br>If the domain controllers require smart card EKU either:</br>- SmartCardLogon</br>- id-pkinit-KPClientAuth (1.3.6.1.5.2.3.4)</br>Otherwise:</br>- TLS/SSL Client Authentication (1.3.6.1.5.5.7.3.2) |
|
||||
|
||||
## NDES server configuration
|
||||
|
||||
The NDES server is required to be configured so that incoming SCEP requests can be mapped to the correct template to be used.
|
||||
For more information, see [Configure certificate infrastructure for SCEP](https://docs.microsoft.com/en-us/intune/deploy-use/Configure-certificate-infrastructure-for-scep).
|
||||
|
||||
## Active Directory requirements
|
||||
|
||||
You need IP connectivity to a DNS server and domain controller over the network interface so that authentication can succeed as well.
|
||||
|
||||
The domain controllers will need to have appropriate KDC certificates for the client to trust them as domain controllers, and since phones are not domain-joined, the root CA of the KDC’s certificate must be in the Third-Party Root CA or Smart Card Trusted Roots store.
|
||||
|
||||
The domain controllers must be using certificates based on the updated KDC certificate template Kerberos Authentication.
|
||||
This is because Windows 10 Mobile requires strict KDC validation to be enabled.
|
||||
This requires that all authenticating domain controllers run Windows Server 2016, or you'll need to enable strict KDC validation on domain controllers that run previous versions of Windows Server.
|
||||
For more information, see [Enabling Strict KDC Validation in Windows Kerberos](https://www.microsoft.com/download/details.aspx?id=6382).
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 94 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 2.4 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 82 KiB |
BIN
windows/security/identity-protection/vpn/images/vpn-eap-xml.png
Normal file
BIN
windows/security/identity-protection/vpn/images/vpn-eap-xml.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 8.5 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 53 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 22 KiB |
BIN
windows/security/identity-protection/vpn/images/vpn-split.png
Normal file
BIN
windows/security/identity-protection/vpn/images/vpn-split.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
@ -0,0 +1,62 @@
|
||||
---
|
||||
title: VPN authentication options (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN authentication options
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
In addition to older and less-secure password-based authentication methods (which should be avoided), the built-in VPN solution uses Extensible Authentication Protocol (EAP) to provide secure authentication using both user name and password, and certificate-based methods. You can only configure EAP-based authentication if you select a built-in VPN type (IKEv2, L2TP, PPTP or Automatic).
|
||||
|
||||
Windows supports a number of EAP authentication methods.
|
||||
|
||||
<table>
|
||||
<thead><tr><th>Method</th><th>Details</th></thead>
|
||||
<tbody>
|
||||
<tr><td>EAP-Microsoft Challenge Handshake Authentication Protocol version 2 (EAP-MSCHAPv2)</td><td><ul><li>User name and password authentication</li><li>Winlogon credentials - can specify authentication with computer sign-in credentials</li></ul></td></tr>
|
||||
<tr><td>EAP-Transport Layer Security (EAP-TLS) </td><td><ul><li>Supports the following types of certificate authentication<ul><li>Certificate with keys in the software Key Storage Provider (KSP)</li><li>Certificate with keys in Trusted Platform Module (TPM) KSP</li><li>Smart card certficates</li><li>Windows Hello for Business certificate</li></ul></li><li>Certificate filtering<ul><li>Certificate filtering can be enabled to search for a particular certificate to use to authenticate with</li><li>Filtering can be Issuer-based or Enhanced Key Usage (EKU)-based</li></ul></li><li>Server validation - with TLS, server validation can be toggled on or off<ul><li>Server name - specify the server to validate</li><li>Server certificate - trusted root certificate to validate the server</li><li>Notification - specify if the user should get a notification asking whether to trust the server or not</li></ul></li></ul></td></tr>
|
||||
<tr><td><a href="https://msdn.microsoft.com/library/cc754179.aspx">Protected Extensible Authentication Protocol (PEAP)</a></td><td><ul><li>Server validation - with PEAP, server validation can be toggled on or off<ul><li>Server name - specify the server to validate</li><li>Server certificate - trusted root certificate to validate the server</li><li>Notification - specify if the user should get a notification asking whether to trust the server or not</li></ul></li><li>Inner method - the outer method creates a secure tunnel inside while the inner method is used to complete the authentication<ul><li>EAP-MSCHAPv2</li><li>EAP-TLS</li></ul><li>Fast Reconnect: reduces the delay between an authentication request by a client and the response by the Network Policy Server (NPS) or other Remote Authentication Dial-in User Service (RADIUS) server. This reduces resource requirements for both client and server, and minimizes the number of times that users are prompted for credentials.<li><a href="https://msdn.microsoft.com/library/cc238384.aspx">Cryptobinding</a>: By deriving and exchanging values from the PEAP phase 1 key material (<b>Tunnel Key</b>) and from the PEAP phase 2 inner EAP method key material (<b>Inner Session Key</b>), it is possible to prove that the two authentications terminate at the same two entities (PEAP peer and PEAP server). This process, termed "cryptobinding", is used to protect the PEAP negotiation against "Man in the Middle" attacks.</li></li></ul></td></tr>
|
||||
<tr><td>Tunneled Transport Layer Security (TTLS)</td><td><ul><li>Inner method<ul><li>Non-EAP<ul><li>Password Authentication Protocol (PAP)</li><li>CHAP</li><li>MSCHAP</li><li>MSCHAPv2</li></ul></li><li>EAP<ul><li>MSCHAPv2</li><li>TLS</li></ul></li></ul></li><li>Server validation: in TTLS, the server must be validated. The following can be configured:<ul><li>Server name</li><li>Trusted root certificate for server certificate</li><li>Whether there should be a server validation notification</li></ul></li></ul></td></tr></tbody>
|
||||
</table>
|
||||
</br>
|
||||
|
||||
For a UWP VPN plug-in, the app vendor controls the authentication method to be used. The following credential types can be used:
|
||||
|
||||
- Smart card
|
||||
- Certificate
|
||||
- Windows Hello for Business
|
||||
- User name and password
|
||||
- One-time password
|
||||
- Custom credential type
|
||||
|
||||
## Configure authentication
|
||||
|
||||
See [EAP configuration](https://msdn.microsoft.com/library/windows/hardware/mt168513.aspx) for EAP XML configuration.
|
||||
|
||||
>[!NOTE]
|
||||
>To configure Windows Hello for Business authentication, follow the steps in [EAP configuration](https://msdn.microsoft.com/library/windows/hardware/mt168513.aspx) to create a smart card certificate. [Learn more about Windows Hello for Business.](https://technet.microsoft.com/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport)
|
||||
|
||||
The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP).
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,89 @@
|
||||
---
|
||||
title: VPN auto-triggered profile options (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN auto-triggered profile options
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
In Windows 10, a number of features were added to auto-trigger VPN so users won’t have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules:
|
||||
|
||||
- App trigger
|
||||
- Name-based trigger
|
||||
- Always On
|
||||
|
||||
## App trigger
|
||||
|
||||
VPN profiles in Windows 10 can be configured to connect automatically on the launch of a specified set of applications. You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection. You can also configure per-app VPN and specify traffic rules for each app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
|
||||
The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name.
|
||||
|
||||
[Find a package family name (PFN) for per-app VPN configuration](https://docs.microsoft.com/intune/deploy-use/find-a-pfn-for-per-app-vpn)
|
||||
|
||||
|
||||
## Name-based trigger
|
||||
|
||||
You can configure a domain name-based rule so that a specific domain name triggers the VPN connection.
|
||||
|
||||
Name-based auto-trigger can be configured using the VPNv2/*ProfileName*/DomainNameInformationList/dniRowId/AutoTrigger setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
There are four types of name-based triggers:
|
||||
|
||||
- Short name: for example, if **HRweb** is configured as a trigger and the stack sees a DNS resolution request for **HRweb**, the VPN will be triggered.
|
||||
- Fully-qualified domain name (FQDN): for example, if **HRweb.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request for **HRweb.corp.contoso.com**, the VPN will be triggered.
|
||||
- Suffix: for example, if **.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request with a matching suffix (such as **HRweb.corp.contoso.com**), the VPN will be triggered. For any short name resolution, VPN will be triggered and the DNS server will be queried for the *ShortName*.**corp.contoso.com**.
|
||||
- All: if used, all DNS resolution should trigger VPN.
|
||||
|
||||
|
||||
## Always On
|
||||
|
||||
Always On is a feature in Windows 10 which enables the active VPN profile to connect automatically on the following triggers:
|
||||
|
||||
- User sign-in
|
||||
- Network change
|
||||
- Device screen on
|
||||
|
||||
When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction.
|
||||
|
||||
|
||||
When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**.
|
||||
|
||||
## Trusted network detection
|
||||
|
||||
This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffices. The VPN stack will look at the DNS suffix on the physical interface and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered.
|
||||
|
||||
Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
|
||||
## Configure app-triggered VPN
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,128 @@
|
||||
---
|
||||
title: VPN and conditional access (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN and conditional access
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application.
|
||||
|
||||
>[!NOTE]
|
||||
>Conditional Access is an Azure AD Premium feature.
|
||||
|
||||
Conditional Access Platform components used for Device Compliance include the following cloud-based services:
|
||||
- [Conditional Access Framework](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/)
|
||||
|
||||
- [Azure AD Connect Health](https://azure.microsoft.com/documentation/articles/active-directory-Azure ADconnect-health/)
|
||||
|
||||
- [Windows Health Attestation Service](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices#device-health-attestation) (optional)
|
||||
|
||||
- Azure AD Certificate Authority - It is a requirement that the client certificate used for the cloud-based device compliance solution be issued by an Azure Active Directory-based Certificate Authority (CA). An Azure AD CA is essentially a mini-CA cloud tenant in Azure. The Azure AD CA cannot be configured as part of an on-premises Enterprise CA.
|
||||
|
||||
- Azure AD-issued short-lived certificates - When a VPN connection attempt is made, the Azure AD Token Broker on the local device communicates with Azure Active Directory, which then checks for health based on compliance rules. If compliant, Azure AD sends back a short-lived certificate that is used to authenticate the VPN. Note that certificate authentication methods such as EAP-TLS can be used.
|
||||
|
||||
Additional details regarding the Azure AD issued short-lived certificate:
|
||||
- The default lifetime is 60 minutes and is configurable
|
||||
- When that certificate expires, the client will again check with Azure AD so that continued health can be validated before a new certificate is issued allowing continuation of the connection
|
||||
|
||||
- [Microsoft Intune device compliance policies](https://docs.microsoft.com/intune/deploy-use/introduction-to-device-compliance-policies-in-microsoft-intune) - Cloud-based device compliance leverages Microsoft Intune Compliance Policies, which are capable of querying the device state and define compliance rules for the following, among other things.
|
||||
|
||||
- Antivirus status
|
||||
- Auto-update status and update compliance
|
||||
- Password policy compliance
|
||||
- Encryption compliance
|
||||
- Device health attestation state (validated against attestation service after query)
|
||||
|
||||
|
||||
The following client-side components are also required:
|
||||
- [HealthAttestation Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn934876.aspx)
|
||||
- [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) DeviceCompliance node settings
|
||||
- Trusted Platform Module (TPM)
|
||||
|
||||
## VPN device compliance
|
||||
|
||||
Server-side infrastructure requirements to support VPN device compliance include:
|
||||
|
||||
- The VPN server should be configured for certificate authentication.
|
||||
- The VPN server should trust the tenant-specific Azure AD CA
|
||||
- Either of the below should be true for Kerberos/NTLM SSO:
|
||||
- Domain servers trust Azure AD CA
|
||||
- A domain-trusted certificate is deployed to the client device and is configured to be used for single sign-on (SSO)
|
||||
|
||||
After the server side is set up, VPN admins can add the policy settings for conditional access to the VPN profile using the VPNv2 DeviceCompliance node.
|
||||
|
||||
Two client-side configuration service providers are leveraged for VPN device compliance.
|
||||
|
||||
- VPNv2 CSP DeviceCompliance settings
|
||||
- **Enabled**: enables the Device Compliance flow from the client. If marked as **true**, the VPN client will attempt to communicate with Azure AD to get a certificate to use for authentication. The VPN should be set up to use certificate authentication and the VPN server must trust the server returned by Azure AD.
|
||||
- **Sso**: nodes under SSO can be used to choose a certificate different from the VPN authentication certificate for Kerberos authentication in the case of device compliance.
|
||||
- **Sso/Enabled**: if this field is set to **true**, the VPN client will look for a separate certificate for Kerberos authentication.
|
||||
- **Sso/IssuerHash**: hashes for the VPN client to look for the correct certificate for Kerberos authentication.
|
||||
- **Sso/Eku**: comma-separated list of Enhanced Key Usage (EKU) extensions for the VPN client to look for the correct certificate for Kerberos authentication.
|
||||
- HealthAttestation CSP (not a requirement) - functions performed by the HealthAttestation CSP include:
|
||||
- Collects TPM data used to verify health states
|
||||
- Forwards the data to the Health Attestation Service (HAS)
|
||||
- Provisions the Health Attestation Certificate received from the HAS
|
||||
- Upon request, forwards the Health Attestation Certificate (received from HAS) and related runtime information to the MDM server for verification
|
||||
|
||||
## Client connection flow
|
||||
|
||||
|
||||
The VPN client side connection flow works as follows:
|
||||
|
||||
|
||||
|
||||
When a Device Compliance-enabled VPN connection profile is triggered (either manually or automatically):
|
||||
|
||||
1. The VPN client calls into Windows 10’s AAD Token Broker, identifying itself as a VPN client.
|
||||
2. The Azure AD Token Broker authenticates to Azure AD and provides it with information about the device trying to connect. The Azure AD Server checks if the device is in compliance with the policies.
|
||||
3. If compliant, Azure AD requests a short-lived certificate
|
||||
4. Azure AD pushes down a short-lived certificate to the Certificate Store via the Token Broker. The Token Broker then returns control back over to the VPN client for further connection processing.
|
||||
5. The VPN client uses the Azure AD-issued certificate to authenticate with the VPN server.
|
||||
|
||||
|
||||
|
||||
## Configure conditional access
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
The following image shows conditional access options in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>In Intune, the certificate selected in **Select a client certificate for client authentication** does not set any VPNv2 CSP nodes. It is simply a way to tie the VPN profile’s successful provisioning to the existence of a certificate. If you are enabling conditional access and using the Azure AD short-lived certificate for both VPN server authentication and domain resource authentication, do not select a certificate since the short-lived certificate is not a certificate that would be on the user’s device yet.
|
||||
|
||||
## Learn more about Conditional Access and Azure AD Health
|
||||
|
||||
- [Azure Active Directory conditional access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access/)
|
||||
- [Getting started with Azure Active Directory Conditional Access](https://azure.microsoft.com/documentation/articles/active-directory-conditional-access-azuread-connected-apps/)
|
||||
- [Control the health of Windows 10-based devices](https://technet.microsoft.com/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 1)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/12/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn/)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 2)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/14/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-2/)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 3)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/15/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-3/)
|
||||
- [Tip of the Day: The Conditional Access Framework and Device Compliance for VPN (Part 4)](https://blogs.technet.microsoft.com/tip_of_the_day/2016/03/16/tip-of-the-day-the-conditional-access-framework-and-device-compliance-for-vpn-part-4/)
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: VPN connection types (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN connection types
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization’s private network.
|
||||
|
||||
There are many options for VPN clients. In Windows 10, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured.
|
||||
|
||||
|
||||
|
||||
## Built-in VPN client
|
||||
|
||||
- Tunneling protocols
|
||||
|
||||
- [Internet Key Exchange version 2 (IKEv2)](https://technet.microsoft.com/library/ff687731.aspx)
|
||||
|
||||
Configure the IPsec/IKE tunnel cryptographic properties using the **Cryptography Suite** setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
- [L2TP](https://technet.microsoft.com/library/ff687761.aspx)
|
||||
|
||||
L2TP with pre-shared key (PSK) authentication can be configured using the **L2tpPsk** setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
- [PPTP](https://technet.microsoft.com/library/ff687676.aspx)
|
||||
|
||||
- [SSTP](https://technet.microsoft.com/library/ff687819.aspx)
|
||||
|
||||
SSTP is supported for Windows desktop editions only. SSTP cannot be configured using mobile device management (MDM), but it is one of the protocols attempted in the **Automatic** option.
|
||||
|
||||
- Automatic
|
||||
|
||||
The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt from most secure to least secure.
|
||||
|
||||
Configure **Automatic** for the **NativeProtocolType** setting in the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
|
||||
|
||||
## Universal Windows Platform VPN plug-in
|
||||
|
||||
The Universal Windows Platform (UWP) VPN plug-ins were introduced in Windows 10, although there were originally separate versions available for the Windows 8.1 Mobile and Windows 8.1 PC platforms. Using the UWP platform, third-party VPN providers can create app-containerized plug-ins using WinRT APIs, eliminating the complexity and problems often associated with writing to system-level drivers.
|
||||
|
||||
There are a number of Universal Windows Platform VPN applications, such as Pulse Secure, Cisco AnyConnect, F5 Access, Sonicwall Mobile Connect, and Check Point Capsule. If you want to use a UWP VPN plug-in, work with your vendor for any custom settings needed to configure your VPN solution.
|
||||
|
||||
## Configure connection type
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
In Intune, you can also include custom XML for third-party plug-in profiles.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
46
windows/security/identity-protection/vpn/vpn-guide.md
Normal file
46
windows/security/identity-protection/vpn/vpn-guide.md
Normal file
@ -0,0 +1,46 @@
|
||||
---
|
||||
title: Windows 10 VPN technical guide (Windows 10)
|
||||
description: Use this guide to configure VPN deployment for Windows 10.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# Windows 10 VPN technical guide
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
This guide will walk you through the decisions you will make for Windows 10 clients in your enterprise VPN solution and how to configure your deployment. This guide references the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/en-us/library/windows/hardware/dn914776.aspx) and provides mobile device management (MDM) configuration instructions using Microsoft Intune and the VPN Profile template for Windows 10.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>This guide does not explain server deployment.
|
||||
|
||||
## In this guide
|
||||
|
||||
| Topic | Description |
|
||||
| --- | --- |
|
||||
| [VPN connection types](vpn-connection-type.md) | Select a VPN client and tunneling protocol |
|
||||
| [VPN routing decisions](vpn-routing.md) | Choose between split tunnel and force tunnel configuration |
|
||||
| [VPN authentication options](vpn-authentication.md) | Select a method for Extensible Authentication Protocol (EAP) authentication. |
|
||||
| [VPN and conditional access](vpn-conditional-access.md) | Use Azure Active Directory policy evaluation to set access policies for VPN connections. |
|
||||
| [VPN name resolution](vpn-name-resolution.md) | Decide how name resolution should work |
|
||||
| [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) | Set a VPN profile to connect automatically by app or by name, to be "always on", and to not trigger VPN on trusted networks |
|
||||
| [VPN security features](vpn-security-features.md) | Set a LockDown VPN profile, configure traffic filtering, and connect VPN profile to Windows Information Protection (WIP) |
|
||||
| [VPN profile options](vpn-profile-options.md) | Combine settings into single VPN profile using XML |
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
- [VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune)
|
||||
|
||||
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: VPN name resolution (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN name resolution
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
When the VPN client connects to the VPN server, the VPN client receives the client IP address. The client may also receive the IP address of the Domain Name System (DNS) server and the IP address of the Windows Internet Name Service (WINS) server.
|
||||
|
||||
The name resolution setting in the VPN profile configures how name resolution should work on the system when VPN is connected. The networking stack first looks at the Name Resolution Policy table (NRPT) for any matches and tries a resolution in the case of a match. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (in the case of a short name) and a DNS query is sent out on the preferred interface. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces.
|
||||
|
||||
## Name Resolution Policy table (NRPT)
|
||||
|
||||
The NRPT is a table of namespaces that determines the DNS client’s behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache.
|
||||
|
||||
There are 3 types of name matches that can set up for NRPT:
|
||||
|
||||
- Fully qualified domain name (FQDN) that can be used for direct matching to a name
|
||||
|
||||
- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (in case of a short name)
|
||||
|
||||
- Any resolution should attempt to first resolve with the proxy server/DNS server with this entry
|
||||
|
||||
NRPT is set using the **VPNv2/*ProfileName*/DomainNameInformationList** node of the [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx). This node also configures Web proxy server or domain name servers.
|
||||
|
||||
[Learn more about NRPT](https://technet.microsoft.com/library/ee649207%28v=ws.10%29.aspx)
|
||||
|
||||
|
||||
## DNS suffix
|
||||
|
||||
This setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established.
|
||||
|
||||
Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node.
|
||||
|
||||
|
||||
|
||||
[Learn more about primaryDNS suffix](https://technet.microsoft.com/library/cc959611.aspx)
|
||||
|
||||
## Persistent
|
||||
|
||||
You can also configure *persistent* name resolution rules. Name resolution for specified items will only performed over VPN.
|
||||
|
||||
Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node.
|
||||
|
||||
|
||||
|
||||
## Configure name resolution
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table.
|
||||
|
||||
| Field | XML |
|
||||
| --- | --- |
|
||||
| **Name** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DomainName** |
|
||||
| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** |
|
||||
| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
318
windows/security/identity-protection/vpn/vpn-profile-options.md
Normal file
318
windows/security/identity-protection/vpn/vpn-profile-options.md
Normal file
@ -0,0 +1,318 @@
|
||||
---
|
||||
title: VPN profile options (Windows 10)
|
||||
description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect.
|
||||
ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN profile options
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
Most of the VPN settings in Windows 10 can be configured in VPN profiles using Microsoft Intune or System Center Configuration Manager. All VPN settings in Windows 10 can be configued using the **ProfileXML** node in the [VPNv2 configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
>[!NOTE]
|
||||
>If you're not familiar with CSPs, read [Introduction to configuration service providers (CSPs)](https://technet.microsoft.com/itpro/windows/manage/how-it-pros-can-use-configuration-service-providers) first.
|
||||
|
||||
The following table lists the VPN settings and whether the setting can be configured in Intune and Configuration Manager, or can only be configured using **ProfileXML**.
|
||||
|
||||
| Profile setting | Can be configured in Intune and Configuration Manager |
|
||||
| --- | --- |
|
||||
| Connection type | yes |
|
||||
| Routing: split-tunnel routes | yes, except exclusion routes |
|
||||
| Routing: forced-tunnel | yes |
|
||||
| Authentication (EAP) | yes, if connection type is built-in |
|
||||
| Conditional access | yes |
|
||||
| Proxy settings | yes, by PAC/WPAD file or server and port |
|
||||
| Name resolution: NRPT | yes |
|
||||
| Name resolution: DNS suffix | no |
|
||||
| Name resolution: persistent | no |
|
||||
| Auto-trigger: app trigger | yes |
|
||||
| Auto-trigger: name trigger | yes |
|
||||
| Auto-trigger: Always On | no |
|
||||
| Auto-trigger: trusted network detection | no |
|
||||
| LockDown | no |
|
||||
| Windows Information Protection (WIP) | no |
|
||||
| Traffic filters | yes |
|
||||
|
||||
The ProfileXML node was added to the VPNv2 CSP to allow users to deploy VPN profile as a single blob. This is particularly useful for deploying profiles with features that are not yet supported by MDMs. You can get additional examples in the [ProfileXML XSD](https://msdn.microsoft.com/library/windows/hardware/mt755930.aspx) topic.
|
||||
|
||||
|
||||
## Sample Native VPN profile
|
||||
|
||||
The following is a sample Native VPN profile. This blob would fall under the ProfileXML node.
|
||||
|
||||
```
|
||||
<VPNProfile>
|
||||
<ProfileName>TestVpnProfile</ProfileName>
|
||||
<NativeProfile>
|
||||
<Servers>testServer.VPN.com</Servers>
|
||||
<NativeProtocolType>IKEv2</NativeProtocolType>
|
||||
|
||||
<!--Sample EAP profile (PEAP)-->
|
||||
<Authentication>
|
||||
<UserMethod>Eap</UserMethod>
|
||||
<MachineMethod>Eap</MachineMethod>
|
||||
<Eap>
|
||||
<Configuration>
|
||||
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||
<EapMethod>
|
||||
<Type xmlns="http://www.microsoft.com/provisioning/EapCommon">25</Type>
|
||||
<VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId>
|
||||
<VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType>
|
||||
<AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId>
|
||||
</EapMethod>
|
||||
<Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
|
||||
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
|
||||
<Type>25</Type>
|
||||
<EapType xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV1">
|
||||
<ServerValidation>
|
||||
<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
|
||||
<ServerNames></ServerNames>
|
||||
<TrustedRootCA>d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 </TrustedRootCA>
|
||||
<TrustedRootCA>d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 </TrustedRootCA>
|
||||
</ServerValidation>
|
||||
<FastReconnect>true</FastReconnect>
|
||||
<InnerEapOptional>false</InnerEapOptional>
|
||||
<Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1">
|
||||
<Type>13</Type>
|
||||
<EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1">
|
||||
<CredentialsSource>
|
||||
<CertificateStore>
|
||||
<SimpleCertSelection>true</SimpleCertSelection>
|
||||
</CertificateStore>
|
||||
</CredentialsSource>
|
||||
<ServerValidation>
|
||||
<DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation>
|
||||
<ServerNames></ServerNames>
|
||||
<TrustedRootCA>d2 d3 8e ba 60 ca a1 c1 20 55 a2 e1 c8 3b 15 ad 45 01 10 c2 </TrustedRootCA>
|
||||
<TrustedRootCA>d1 76 97 cc 20 6e d2 6e 1a 51 f5 bb 96 e9 35 6d 6d 61 0b 74 </TrustedRootCA>
|
||||
</ServerValidation>
|
||||
<DifferentUsername>false</DifferentUsername>
|
||||
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation>
|
||||
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">false</AcceptServerName>
|
||||
<TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
|
||||
<FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3">
|
||||
<EKUMapping>
|
||||
<EKUMap>
|
||||
<EKUName>AAD Conditional Access</EKUName>
|
||||
<EKUOID>1.3.6.1.4.1.311.87</EKUOID>
|
||||
</EKUMap>
|
||||
</EKUMapping>
|
||||
<ClientAuthEKUList Enabled="true">
|
||||
<EKUMapInList>
|
||||
<EKUName>AAD Conditional Access</EKUName>
|
||||
</EKUMapInList>
|
||||
</ClientAuthEKUList>
|
||||
</FilteringInfo>
|
||||
</TLSExtensions>
|
||||
</EapType>
|
||||
</Eap>
|
||||
<EnableQuarantineChecks>false</EnableQuarantineChecks>
|
||||
<RequireCryptoBinding>true</RequireCryptoBinding>
|
||||
<PeapExtensions>
|
||||
<PerformServerValidation xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">true</PerformServerValidation>
|
||||
<AcceptServerName xmlns="http://www.microsoft.com/provisioning/MsPeapConnectionPropertiesV2">false</AcceptServerName>
|
||||
</PeapExtensions>
|
||||
</EapType>
|
||||
</Eap>
|
||||
</Config>
|
||||
</EapHostConfig>
|
||||
</Configuration>
|
||||
</Eap>
|
||||
</Authentication>
|
||||
|
||||
<!--Sample routing policy: in this case, this is a split tunnel configuration with two routes configured-->
|
||||
<RoutingPolicyType>SplitTunnel</RoutingPolicyType>
|
||||
<DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
|
||||
</NativeProfile>
|
||||
<Route>
|
||||
<Address>192.168.0.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>10.10.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
</Route>
|
||||
|
||||
<!--VPN will be triggered for the two apps specified here-->
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>C:\windows\system32\ping.exe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
|
||||
<!--Example of per-app VPN. This configures traffic filtering rules for two apps. Internet Explorer is configured for force tunnel, meaning that all traffic allowed through this app must go over VPN. Microsoft Edge is configured as split tunnel, so whether data goes over VPN or the physical interface is dictated by the routing configuration.-->
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
<Protocol>6</Protocol>
|
||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||
<RoutingPolicyType>ForceTunnel</RoutingPolicyType>
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||
</TrafficFilter>
|
||||
|
||||
<!--Name resolution configuration. The AutoTrigger node configures name-based triggering. In this profile, the domain "hrsite.corporate.contoso.com" triggers VPN.-->
|
||||
<DomainNameInformation>
|
||||
<DomainName>hrsite.corporate.contoso.com</DomainName>
|
||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||
<AutoTrigger>true</AutoTrigger>
|
||||
</DomainNameInformation>
|
||||
<DomainNameInformation>
|
||||
<DomainName>.corp.contoso.com</DomainName>
|
||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||
</DomainNameInformation>
|
||||
|
||||
<!--EDPMode is turned on for the enterprise ID "corp.contoso.com". When a user accesses an app with that ID, VPN will be triggered.-->
|
||||
<EdpModeId>corp.contoso.com</EdpModeId>
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
|
||||
<!--Always On is turned off, and triggering VPN for the apps and domain name specified earlier in the profile will not occur if the user is connected to the trusted network "contoso.com".-->
|
||||
<AlwaysOn>false</AlwaysOn>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<TrustedNetworkDetection>contoso.com</TrustedNetworkDetection>
|
||||
<Proxy>
|
||||
<Manual>
|
||||
<Server>HelloServer</Server>
|
||||
</Manual>
|
||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||
</Proxy>
|
||||
|
||||
<!--Device compliance is enabled and an alternate certificate is specified for domain resource authentication.-->
|
||||
<DeviceCompliance>
|
||||
<Enabled>true</Enabled>
|
||||
<Sso>
|
||||
<Enabled>true</Enabled>
|
||||
<Eku>This is my Eku</Eku>
|
||||
<IssuerHash>This is my issuer hash</IssuerHash>
|
||||
</Sso>
|
||||
</DeviceCompliance>
|
||||
</VPNProfile>
|
||||
```
|
||||
|
||||
## Sample plug-in VPN profile
|
||||
|
||||
The following is a sample plug-in VPN profile. This blob would fall under the ProfileXML node.
|
||||
|
||||
```
|
||||
<VPNProfile>
|
||||
<ProfileName>TestVpnProfile</ProfileName>
|
||||
<PluginProfile>
|
||||
<ServerUrlList>testserver1.contoso.com;testserver2.contoso..com</ServerUrlList>
|
||||
<PluginPackageFamilyName>JuniperNetworks.JunosPulseVpn_cw5n1h2txyewy</PluginPackageFamilyName>
|
||||
<CustomConfiguration><pulse-schema><isSingleSignOnCredential>true</isSingleSignOnCredential></pulse-schema></CustomConfiguration>
|
||||
</PluginProfile>
|
||||
<Route>
|
||||
<Address>192.168.0.0</Address>
|
||||
<PrefixSize>24</PrefixSize>
|
||||
</Route>
|
||||
<Route>
|
||||
<Address>10.10.0.0</Address>
|
||||
<PrefixSize>16</PrefixSize>
|
||||
</Route>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<AppTrigger>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
</AppTrigger>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>%ProgramFiles%\Internet Explorer\iexplore.exe</Id>
|
||||
</App>
|
||||
<Protocol>6</Protocol>
|
||||
<LocalPortRanges>10,20-50,100-200</LocalPortRanges>
|
||||
<RemotePortRanges>20-50,100-200,300</RemotePortRanges>
|
||||
<RemoteAddressRanges>30.30.0.0/16,10.10.10.10-20.20.20.20</RemoteAddressRanges>
|
||||
<!--<RoutingPolicyType>ForceTunnel</RoutingPolicyType>-->
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<LocalAddressRanges>3.3.3.3/32,1.1.1.1-2.2.2.2</LocalAddressRanges>
|
||||
</TrafficFilter>
|
||||
<TrafficFilter>
|
||||
<App>
|
||||
<Id>Microsoft.MicrosoftEdge_8wekyb3d8bbwe</Id>
|
||||
</App>
|
||||
<Claims>O:SYG:SYD:(A;;CC;;;AU)</Claims>
|
||||
<!--<RoutingPolicyType>SplitTunnel</RoutingPolicyType>-->
|
||||
</TrafficFilter>
|
||||
<DomainNameInformation>
|
||||
<DomainName>corp.contoso.com</DomainName>
|
||||
<DnsServers>1.2.3.4,5.6.7.8</DnsServers>
|
||||
<WebProxyServers>5.5.5.5</WebProxyServers>
|
||||
<AutoTrigger>false</AutoTrigger>
|
||||
</DomainNameInformation>
|
||||
<DomainNameInformation>
|
||||
<DomainName>corp.contoso.com</DomainName>
|
||||
<DnsServers>10.10.10.10,20.20.20.20</DnsServers>
|
||||
<WebProxyServers>100.100.100.100</WebProxyServers>
|
||||
</DomainNameInformation>
|
||||
<!--<EdpModeId>corp.contoso.com</EdpModeId>-->
|
||||
<RememberCredentials>true</RememberCredentials>
|
||||
<AlwaysOn>false</AlwaysOn>
|
||||
<DnsSuffix>corp.contoso.com</DnsSuffix>
|
||||
<TrustedNetworkDetection>contoso.com,test.corp.contoso.com</TrustedNetworkDetection>
|
||||
<Proxy>
|
||||
<Manual>
|
||||
<Server>HelloServer</Server>
|
||||
</Manual>
|
||||
<AutoConfigUrl>Helloworld.Com</AutoConfigUrl>
|
||||
</Proxy>
|
||||
</VPNProfile>
|
||||
|
||||
```
|
||||
|
||||
## Apply ProfileXML using Intune
|
||||
|
||||
After you configure the settings that you want using ProfileXML, you can apply it using Intune and a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy.
|
||||
|
||||
The OMS-URI setting to apply ProfileXML is **./user/vendor/MSFT/*VPN profile name*/ProfileXML**.
|
||||
|
||||
|
||||
|
||||
## Learn more
|
||||
|
||||
- [Learn how to configure VPN connections in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/vpn-connections-in-microsoft-intune)
|
||||
- [VPNv2 configuration service provider (CSP) reference](https://go.microsoft.com/fwlink/p/?LinkId=617588)
|
||||
- [How to Create VPN Profiles in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=618028)
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
69
windows/security/identity-protection/vpn/vpn-routing.md
Normal file
69
windows/security/identity-protection/vpn/vpn-routing.md
Normal file
@ -0,0 +1,69 @@
|
||||
---
|
||||
title: VPN routing decisions (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN routing decisions
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
Network routes are required for the stack to understand which interface to use for outbound traffic. One of the most important decision points for VPN configuration is whether you want to send all the data through VPN (*force tunnel*) or only some data through the VPN (*split tunnel*). This decision impacts the configuration and the capacity planning, as well as security expectations from the connection.
|
||||
|
||||
## Split tunnel configuration
|
||||
|
||||
In a split tunnel configuration, routes can be specified to go over VPN and all other traffic will go over the physical interface.
|
||||
|
||||
Routes can be configured using the VPNv2/*ProfileName*/RouteList setting in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx).
|
||||
|
||||
For each route item in the list, the following can be specified:
|
||||
|
||||
- **Address**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Address
|
||||
- **Prefix size**: VPNv2/*ProfileName*/RouteList/*routeRowId*/Prefix
|
||||
- **Exclusion route**: VPNv2/*ProfileName*/RouteList/*routeRowId*/ExclusionRoute
|
||||
|
||||
Windows VPN platform now supports the ability to specify exclusion routes that specifically should not go over the physical interface.
|
||||
|
||||
Routes can also be added at connect time through the server for UWP VPN apps.
|
||||
|
||||
## Force tunnel configuration
|
||||
|
||||
In a force tunnel configuration, all traffic will go over VPN. This is the default configuration and takes effect if no routes are specified.
|
||||
|
||||
The only implication of this setting is the manipulation of routing entries. In the case of a force tunnel, VPN V4 and V6 default routes (for example. 0.0.0.0/0) are added to the routing table with a lower metric than ones for other interfaces. This sends traffic through the VPN as long as there isn’t a specific route on the physical interface itself.
|
||||
|
||||
For built-in VPN, this decision is controlled using the MDM setting **VPNv2/ProfileName/NativeProfile/RoutingPolicyType**.
|
||||
|
||||
For a UWP VPN plug-in, this property is directly controlled by the app. If the VPN plug-in indicates the default route for IPv4 and IPv6 as the only two Inclusion routes, the VPN platform marks the connection as Force Tunneled.
|
||||
|
||||
## Configure routing
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration.
|
||||
|
||||
|
||||
|
||||
Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN security features](vpn-security-features.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
@ -0,0 +1,88 @@
|
||||
---
|
||||
title: VPN security features (Windows 10)
|
||||
description: tbd
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security, networking
|
||||
author: jdeckerms
|
||||
ms.localizationpriority: high
|
||||
ms.date: 07/27/2017
|
||||
---
|
||||
|
||||
# VPN security features
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows 10 Mobile
|
||||
|
||||
|
||||
## LockDown VPN
|
||||
|
||||
A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features:
|
||||
|
||||
- The system attempts to keep the VPN connected at all times.
|
||||
- The user cannot disconnect the VPN connection.
|
||||
- The user cannot delete or modify the VPN profile.
|
||||
- The VPN LockDown profile uses forced tunnel connection.
|
||||
- If the VPN connection is not available, outbound network traffic is blocked.
|
||||
- Only one VPN LockDown profile is allowed on a device.
|
||||
|
||||
>[!NOTE]
|
||||
>For built-in VPN, Lockdown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type.
|
||||
|
||||
Deploy this feature with caution as the resultant connection will not be able to send or receive any network traffic without the VPN being connected.
|
||||
|
||||
|
||||
|
||||
## Windows Information Protection (WIP) integration with VPN
|
||||
|
||||
Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally.
|
||||
|
||||
The **EdpModeId** node in the [VPNv2 Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) allows a Windows 10 VPN client to integrate with WIP, extending its functionality to remote devices. Use case scenarios for WIP include:
|
||||
|
||||
- Core functionality: File encryption and file access blocking
|
||||
- UX policy enforcement: Restricting copy/paste, drag/drop, and sharing operations
|
||||
- WIP network policy enforcement: Protecting intranet resources over the corporate network and VPN
|
||||
- Network policy enforcement: Protecting SMB and Internet cloud resources over the corporate network and VPN
|
||||
|
||||
The value of the **EdpModeId** is an Enterprise ID. The networking stack will look for this ID in the app token to determine whether VPN should be triggered for that particular app.
|
||||
|
||||
Additionally, when connecting with WIP, the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced configuration is needed) because the WIP policies and App lists automatically take effect.
|
||||
|
||||
[Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
|
||||
|
||||
## Traffic filters
|
||||
|
||||
Traffic Filters give enterprises the ability to decide what traffic is allowed into the corporate network based on policy. Network admins to effectively add interface specific firewall rules on the VPN Interface.There are two types of Traffic Filter rules:
|
||||
|
||||
- App-based rules. With app-based rules, a list of applications can be marked such that only traffic originating from these apps is allowed to go over the VPN interface.
|
||||
- Traffic-based rules. Traffic-based rules are 5-tuple policies (ports, addresses, protocol) that can be specified such that only traffic matching these rules is allowed to go over the VPN interface.
|
||||
|
||||
There can be many sets of rules which are linked by OR. Within each set, there can be app-based rules and traffic-based rules; all the properties within the set will be linked by AND. In addition, these rules can be applied at a per-app level or a per-device level.
|
||||
|
||||
For example, an admin could define rules that specify:
|
||||
|
||||
- The Contoso HR App must be allowed to go through the VPN and only access port 4545.
|
||||
- The Contoso finance apps is allowed to go over the VPN and only access the Remote IP ranges of 10.10.0.40 - 10.10.0.201 on port 5889.
|
||||
- All other apps on the device should be able to access only ports 80 or 443.
|
||||
|
||||
## Configure traffic filters
|
||||
|
||||
See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.microsoft.com/library/windows/hardware/dn914776.aspx) for XML configuration.
|
||||
|
||||
The following image shows the interface to configure traffic rules in a VPN Profile configuration policy using Microsoft Intune.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [VPN technical guide](vpn-guide.md)
|
||||
- [VPN connection types](vpn-connection-type.md)
|
||||
- [VPN routing decisions](vpn-routing.md)
|
||||
- [VPN authentication options](vpn-authentication.md)
|
||||
- [VPN and conditional access](vpn-conditional-access.md)
|
||||
- [VPN name resolution](vpn-name-resolution.md)
|
||||
- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md)
|
||||
- [VPN profile options](vpn-profile-options.md)
|
||||
Reference in New Issue
Block a user