diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md deleted file mode 100644 index e4a3663a4b..0000000000 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: VPN auto-triggered profile options -description: Learn about the types of auto-trigger rules for VPNs in Windows, which start a VPN when it is needed to access a resource. -ms.date: 09/23/2021 -ms.topic: conceptual ---- - -# VPN auto-triggered profile options - -In Windows 10 and Windows 11, a number of features have been added to auto-trigger VPN so users won't have to manually connect when VPN is needed to access necessary resources. There are three different types of auto-trigger rules: - -- App trigger -- Name-based trigger -- Always On - -> [!NOTE] -> Auto-triggered VPN connections will not work if Folder Redirection for AppData is enabled. Either Folder Redirection for AppData must be disabled or the auto-triggered VPN profile must be deployed in system context, which changes the path to where the rasphone.pbk file is stored. - - -## App trigger - -VPN profiles in Windows 10 or Windows 11 can be configured to connect automatically on the launch of a specified set of applications. You can configure desktop or Universal Windows Platform (UWP) apps to trigger a VPN connection. You can also configure per-app VPN and specify traffic rules for each app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. - -The app identifier for a desktop app is a file path. The app identifier for a UWP app is a package family name. - -[Find a package family name (PFN) for per-app VPN configuration](/mem/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) - -## Name-based trigger - -You can configure a domain name-based rule so that a specific domain name triggers the VPN connection. - -Name-based auto-trigger can be configured using the VPNv2/*ProfileName*/DomainNameInformationList/dniRowId/AutoTrigger setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp). - -There are four types of name-based triggers: - -- Short name: for example, if **HRweb** is configured as a trigger and the stack sees a DNS resolution request for **HRweb**, the VPN will be triggered. -- Fully-qualified domain name (FQDN): for example, if **HRweb.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request for **HRweb.corp.contoso.com**, the VPN will be triggered. -- Suffix: for example, if **.corp.contoso.com** is configured as a trigger and the stack sees a DNS resolution request with a matching suffix (such as **HRweb.corp.contoso.com**), the VPN will be triggered. For any short name resolution, VPN will be triggered and the DNS server will be queried for the *ShortName*.**corp.contoso.com**. -- All: if used, all DNS resolution should trigger VPN. - - -## Always On - -Always On is a feature in Windows 10 and Windows 11 which enables the active VPN profile to connect automatically on the following triggers: - -- User sign-in -- Network change -- Device screen on - -When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction. - - -When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers. - -## Preserving user Always On preference - -Windows has a feature to preserve a user's AlwaysOn preference. In the event that a user manually unchecks the "Connect automatically" checkbox, Windows will remember this user preference for this profile name by adding the profile name to the value **AutoTriggerDisabledProfilesList**. - -Should a management tool remove or add the same profile name back and set **AlwaysOn** to **true**, Windows will not check the box if the profile name exists in the following registry value in order to preserve user preference. - -**Key:** HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Config
-**Value:** AutoTriggerDisabledProfilesList
-**Type:** REG_MULTI_SZ - - -## Trusted network detection - -This feature configures the VPN such that it would not get triggered if a user is on a trusted corporate network. The value of this setting is a list of DNS suffixes. The VPN stack will look at the network name of the physical interface connection profile and if it matches any in the configured list and the network is private or provisioned by MDM, then VPN will not get triggered. - -Trusted network detection can be configured using the VPNv2/*ProfileName*/TrustedNetworkDetection setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). - - -## Configure app-triggered VPN - -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration. - -The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune. - -![Add an app for the VPN connection.](images/vpn-app-trigger.png) - -After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. - -![Configure rules for the app.](images/vpn-app-rules.png) - -## Related topics - -- [VPN technical guide](vpn-guide.md) -- [VPN connection types](vpn-connection-type.md) -- [VPN routing decisions](vpn-routing.md) -- [VPN authentication options](vpn-authentication.md) -- [VPN and conditional access](vpn-conditional-access.md) -- [VPN name resolution](vpn-name-resolution.md) -- [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md deleted file mode 100644 index 676407b855..0000000000 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: VPN connection types -description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured. -ms.date: 08/23/2021 -ms.topic: conceptual ---- - -# VPN connection types - -Virtual private networks (VPNs) are point-to-point connections across a private or public network, such as the Internet. A VPN client uses special TCP/IP or UDP-based protocols, called *tunneling protocols*, to make a virtual call to a virtual port on a VPN server. In a typical VPN deployment, a client initiates a virtual point-to-point connection to a remote access server over the Internet. The remote access server answers the call, authenticates the caller, and transfers data between the VPN client and the organization's private network. - -There are many options for VPN clients. In Windows 10 and Windows 11, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. - -![VPN connection types.](images/vpn-connection.png) - -## Built-in VPN client - -- Tunneling protocols - - - [Internet Key Exchange version 2 (IKEv2)](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687731(v=ws.10)) - - Configure the IPsec/IKE tunnel cryptographic properties using the **Cryptography Suite** setting in the [VPNv2 Configuration Service Provider (CSP)](/windows/client-management/mdm/vpnv2-csp). - - - [L2TP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687761(v=ws.10)) - - L2TP with pre-shared key (PSK) authentication can be configured using the **L2tpPsk** setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). - - - [PPTP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687676(v=ws.10)) - - - [SSTP](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff687819(v=ws.10)) - - SSTP is supported for Windows desktop editions only. SSTP cannot be configured using mobile device management (MDM), but it is one of the protocols attempted in the **Automatic** option. - - > [!NOTE] - > When a VPN plug-in is used, the adapter will be listed as an SSTP adapter, even though the VPN protocol used is the plug-in's protocol. - -- Automatic - - The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt from most secure to least secure. - - Configure **Automatic** for the **NativeProtocolType** setting in the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). - - - -## Universal Windows Platform VPN plug-in - -The Universal Windows Platform (UWP) VPN plug-ins were introduced in Windows 10 and Windows 11, although there was originally separate version available for the Windows 8.1 PC platform. Using the UWP platform, third-party VPN providers can create app-containerized plug-ins using WinRT APIs, eliminating the complexity and problems often associated with writing to system-level drivers. - -There are a number of Universal Windows Platform VPN applications, such as Pulse Secure, Cisco AnyConnect, F5 Access, Sonicwall Mobile Connect, and Check Point Capsule. If you want to use a UWP VPN plug-in, work with your vendor for any custom settings needed to configure your VPN solution. - -## Configure connection type - -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration. - -The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: - -> [!div class="mx-imgBorder"] -> ![Available connection types.](images/vpn-connection-intune.png) - -In Intune, you can also include custom XML for third-party plug-in profiles: - -> [!div class="mx-imgBorder"] -> ![Custom XML.](images/vpn-custom-xml-intune.png) - - -## Related topics - -- [VPN technical guide](vpn-guide.md) -- [VPN routing decisions](vpn-routing.md) -- [VPN authentication options](vpn-authentication.md) -- [VPN and conditional access](vpn-conditional-access.md) -- [VPN name resolution](vpn-name-resolution.md) -- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) -- [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md deleted file mode 100644 index c92f0cbbcb..0000000000 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: VPN name resolution -description: Learn how the name resolution setting in the VPN profile configures how name resolution works when a VPN client connects to a VPN server. -ms.date: 09/23/2021 -ms.topic: conceptual ---- - -# VPN name resolution - -When the VPN client connects to the VPN server, the VPN client receives the client IP address. The client may also receive the IP address of the Domain Name System (DNS) server and the IP address of the Windows Internet Name Service (WINS) server. - -The name resolution setting in the VPN profile configures how name resolution should work on the system when VPN is connected. The networking stack first looks at the Name Resolution Policy table (NRPT) for any matches and tries a resolution in the case of a match. If no match is found, the DNS suffix on the most preferred interface based on the interface metric is appended to the name (in the case of a short name) and a DNS query is sent out on the preferred interface. If the query times out, the DNS suffix search list is used in order and DNS queries are sent on all interfaces. - -## Name Resolution Policy table (NRPT) - -The NRPT is a table of namespaces that determines the DNS client's behavior when issuing name resolution queries and processing responses. It is the first place that the stack will look after the DNSCache. - -There are 3 types of name matches that can set up for NRPT: - -- Fully qualified domain name (FQDN) that can be used for direct matching to a name - -- Suffix match results in either a comparison of suffixes (for FQDN resolution) or the appending of the suffix (in case of a short name) - -- Any resolution should attempt to first resolve with the proxy server/DNS server with this entry - -NRPT is set using the **VPNv2/*ProfileName*/DomainNameInformationList** node of the [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp). This node also configures Web proxy server or domain name servers. - -[Learn more about NRPT](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee649207(v=ws.10)) - - -## DNS suffix - -This setting is used to configure the primary DNS suffix for the VPN interface and the suffix search list after the VPN connection is established. - -Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node. - - - -[Learn more about primaryDNS suffix](/previous-versions/windows/it-pro/windows-2000-server/cc959611(v=technet.10)) - -## Persistent - -You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN. - -Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node. - - - -## Configure name resolution - -See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp) for XML configuration. - -The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune. - -![Add DNS rule.](images/vpn-name-intune.png) - -The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table. - -| Field | XML | -| --- | --- | -| **Name** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DomainName** | -| **Servers (comma separated)** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/DnsServers** | -| **Proxy server** | **VPNv2/*ProfileName*/DomainNameInformationList/*dniRowId*/WebServers** | - -## Related topics - -- [VPN technical guide](vpn-guide.md) -- [VPN connection types](vpn-connection-type.md) -- [VPN routing decisions](vpn-routing.md) -- [VPN authentication options](vpn-authentication.md) -- [VPN and conditional access](vpn-conditional-access.md) -- [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) -- [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file