Implementing Microsoft's AOVPN, or something else?

Posted by patchmau5@reddit | sysadmin | View on Reddit | 21 comments

Hi All, I've been looking at replacing our SSL VPN service with something more capable and user-friendly, and at low cost. This is where Microsoft's Always On VPN comes in. We're a hybrid estate, though mostly onprem, but the less 'new' local servers that go in, the better. This seems to warrant at least 3 additional servers to be setup - I may be mistaken here; we already have an NPS server and AD DC. I'm curious to know whether there are alternatives out there that do what Microsoft's AOVPN does but better. The more I read up on it the less reliable it seems to be! If there are any good resources for AOVPN I'd be interested to know. I'm aware of a book that gets touted around, but I'd likely have to pay out of my own pocket for something one-off like this, and the Microsoft materials *appear* to be comprehensive. TIA.

Reply to Post

21 Comments

[-]

Arudinne@reddit

We tried to get AOVPN working for about 2 years and it did work for a bit but it was ultimately unreliable at best so we stuck with Forticlient's SSL VPN. Now that they are phasing that out we're migrating to Fortinet's ZTNA with FortiClient EMS and our Fortigates. Entra Private Access is also an option worth looking at and something I was interested in but the forinet solution is cheaper. https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-private-access However neither of those are free. You could use WireGuard for free, but I am not sure if it would be suitable for your environment.

[-]

patchmau5@reddit (OP)

Having read more I feel less inclined to implement it, however the powers-that-be want to - and I can see why on paper - but our existing solution is so stable by comparison. I’ve trialled a ZTNA product but the environment and applications we use just wouldn’t work: “in-house” apps with scrappy coding that were never designed with ZTNA in mind, and unconventional DNS configurations to get X and Y working… it just wasn’t doable. I will give AOVPN a go and see where we’re at. Appreciate your sharing of experience.

[-]

NoSellDataPlz@reddit

We use AOVPN and it’s pretty decent for the most part. We have some configuration issues to work through, but these haven’t caused any one user to be fully without remote access; it’s just a little unreliable and you have to make multiple disconnect/reconnect’s throughout the day sometimes. It’s not that bad unless there are meetings and screen shares going on when the AOVPN acts strangely.

[-]

funkyferdy@reddit

It's for end users? Were are playing around with Global Secure Access -> Private Access right now and it looks good so far.

[-]

BK_Rich@reddit

Are you using private access to replace another VPN solution? I was curious if it can replace a traditional vpn for reaching on-premises resources and for domain-joined laptops.

[-]

patchmau5@reddit (OP)

I'd be tempted to trial it, but it appears to be a ZTNA, which had limitations in my testing. I'll give AOVPN a go and see where that takes us. That said I'd like to have more in the cloud, so I'm sure our systems will have to change in accordance to where the sector is going.

[-]

streppelchen@reddit

Only issue we faced so far (two dedicated sites providing rras endpoints, 25 concurrent users), is of the provider offers only dualstack lite, as we are an exclusive IPv4 shop currently (other requirements force this currently).

[-]

SpiceIslander2001@reddit

I installed MS AOVPN over a year ago. Easiest the most trouble-free MS solution we've got at the moment. However, it's only used for device-level VPN and even then only to provide access to a small subset of servers, Currently limited to 1,000 clients, but the server can support more if needed. A couple of things to note: 1. Deploy a PKI before deploying AOVPN. Auto-enrollment of client certificates makes life so much easier. The only certificate you really have to worry about then is the public certificate on the AOVPN server. 2. Do NOT run the PS script to create the VPN on the client from a network share or anywhere remote from the PC. Use your client config management solution (GPOs, scripting, Intune, whatever) to run a copy of the PS script from the PC's local storage in a protected area (like under "Program Files"), and use another method to update that copy with the latest version that you have stored on a network share. 3. The script examples that you see on the Internet are pretty basic. Enough to get you started, but that's it. With a bit of Powershell knowledge, you can expand the VPN creation script to be a lot more versatile, like (a) use variables for the routing information, allowing you to easily update it if you have to add or remove access to specific IPs or IP ranges, (b) automatically stop and rebuild the VPN connection if there's no connectivity, (3) copy logs to a central network share on establishment of the VPN link, etc. 4. MS doesn't really provide an easy way of auditing the AOVPN connections. Powershell to the rescue again. It's not that difficult to set up a scheduled task that takes a snapshot of the number of current connections and save it to a CSV file. Then all you need to do is configure it to run as a scheduled task, and presto-zappo you've got a CSV file that can be used to generate those nifty graphs that management always seem to like. I've got a script that takes a snapshot of current connections once an hour, which is enough to keep management happy. 5. Consider configuring the DNS service on the AOVPN server, set the AOVPN server up to use itself for DNS, and add conditional forwarders to the DNS for the internal zones (including your AD) that you want the server and the VPN clients to reach. That addressed some of the problems we ran into early on, where Win10 PCs were for some reason using the wrong DNS IPs for name resolution after creating an AOVPN connection. Configuring the AOVPN server as a DNS as well allowed me to avoid having to eff around with the Windows network config to solve that particular issue.

[-]

TangoCharlie_Reddit@reddit

AOVPN there is but one defecto source - The man, the myth, the MVP legend that is Richard Hicks. https://directaccess.richardhicks.com/

[-]

patchmau5@reddit (OP)

I’d consider buying the book but it appears to be coming up to 4 years old now, do you happen to know if there is a new edition in the works? Or is the content therein still accurate and applicable?

[-]

TangoCharlie_Reddit@reddit

Unfortunately I don’t have the book, despite my whole team and the Infra team knowing the name Richard Hicks like a personal relative. I do owe him my money, and a beer… One of the reasons in the past has been the fluid nature of new issues and bugs with Windows updates and evolution of the product, usually fixed by things found in his blog. A book would be okay for learning the basics and I don’t doubt a great buy, but wouldn’t address my needs this deep in. This said, the product is no longer new, hell of a lot more stable than a couple years ago, fleshed out with DPC advanced config options and such. I have 13k+ endpoints hanging off Device Tunnel (with User Tunnel backup) with a mix of IKE and SSTP support. 2 VPN farms (4 servers each) in 2 countries behind load balancers and with NPS servers / PKI supporting, and generally they ”just work”. No tickets or support, the mix of tunnel and protocol support covering every eventuality. The only bit can’t control is the endpoints and crap ISP’s! Whilst there may be other vendors easier to deploy, at cost, I don’t see any sense in it if you have all the licensing / infra (and staff) to do it.

[-]

ZeroTrusted@reddit

Why bother looking at something that is so hard to find documentation on and requires you to do maintenance you aren't comfortable with? The ADCS set up and maintenance isn't hard but why do it if you don't have the skills? Look at something easier like one of the SASE vendors. Another OP metioned the most popular ones out there, so I won't rehash that. Find one that works best for your needs.

[-]

patchmau5@reddit (OP)

Well, this one won’t cost us anything beyond time. That’s the primary driver for my organisation.

[-]

FunOpportunity7@reddit

I rolled out AOVPN during Covid to replace DirectAccess. The whole setup and implementation was done remotely. Richard Hicks had a lot of great info and really helped to get me over some humps. We did a parallel deployment and replaced DA live with AOVPN via MECM remotely with nearly zero loss in state. We use our Citrix ADC as our gateway and use device tunnels with firewall rules in our DMZ to manage traffic needs. It's been rock solid since it was deployed. We have 2 nodes in each of our sites with GSLB managing the client connections for locality and resilience. All nodes patching happens during the day, and users just shift to another node with no loss in service. I love how it just works. My only annoyance is related to cert management on the nodes specifically, but a calendar reminder is all you need to keep things working. I honestly have had no issues managing this. We regularly have 400 active clients with surges to 600. It's designed for 2000 potential.

[-]

patchmau5@reddit (OP)

Wow. I can't imagine ever having 400 concurrent users on our current VPN service, just isn't the demand there for it. But it's good to know it can. The cert management is one aspect I'm not looking forward to. I expect the maintenance of this to be more than that of our existing product.

[-]

FunOpportunity7@reddit

It's really not an issue. It's just a maintenance process. If you don't have a PKI running, there is a bit more work, but using auto enrollments and then it is just a few reoccurring events over time. We have ADCS running and have for a long time, so it was creating the template, setting up the policies and gpos, and building the deployment package. Once done, the rest was pretty trivial. My only complaint on certs is having to manually activate the certs on the nodes for RRAS to use them. Wish it would do it without manual action. But it's annual, so it's 1 day a year.

[-]

patchmau5@reddit (OP)

Will have to look into it. We don’t have AD CS set up and will be a learning curve for me.

[-]

mapbits@reddit

Second the recommendation for Richard Hicks - buy his book. You can do AOVPN with a single server, depends on your availability requirements. I did it practically overnight during a rapid onramp in early pandemic, and it was pretty darned reliable - most issues were actually related to ADCS availability. There were some conditions that I benefited from; our CRLs and AIAs were all published as web based, and externally available. You can bypass this but it is a reduction in your security posture. If you are looking for highly available, make sure to look at NPS and ADCS as well.

[-]

Jimmyv81@reddit

We've been using aovpn for the past 3-4 years primarily using Sstp rather than IKE. It has been rock solid for approx 500 users. No issues at all with it. You'll ideally need 2 VPN servers at least for HA. Also a radius server like NPS or Aruba Clearpass. VPN config and certificates are pushed to clients via Intune. As mentioned Richard Hicks is the goto resource for all things aovpn. The only concern is that Microsoft is now hard pushing Entra private acces as their primary VPN solution. It wouldn't surprise me if they "deprecate" aovpn in the near future.

[-]

RandomThrowAways0@reddit

It took us a little while to get going, but overall, the process was pretty smooth once implemented. It goes through Entra to issue 1-hour lifetime certs just to get connected initially, and then a machine cert issued from your PKI provider. Our VPN tickets have gone from a couple percent month to 1 or 2 per year. It just works. If I had to do it all again, I'd probably just setup one of the many docker SSE/Wireguard solutions out there like Tailscale, Twingate, Netbird, Netmaker, etc.

[-]

twaijn@reddit

AOVPN is just IPsec with IKEv2 and EAP-TLS. Instead of using and patching Windows Servers, we got a FortiGate (spec for your needs) and use it as the AOVPN gateway. We use AOVPN only with a device tunnel. Another option, which I would recommend to replace SSL-VPN, would be the open source Let’s Connect VPN with WireGuard, if you can work with Linux.