Windows Always On VPN (AOVPN) Deployment Guide: How to Replace Traditional VPN with a Modern Remote Access Architecture

Device Tunnel:

• Connects: Before user logon, using the machine certificate
• Authentication: Machine certificate (no user credentials needed)
• Use cases: Group Policy refresh before logon, SCCM client communication, BitLocker network unlock, domain join from remote location
• Configuration: Requires Windows 10 Enterprise/Education or Windows 11, run as a VPN connection for the SYSTEM account
• Traffic: Typically restricted to specific DC, SCCM, and DNS server IPs (not full tunnel) -- keep Device Tunnel narrow

User Tunnel:

• Connects: After the user signs in, using the user certificate or user credentials
• Authentication: User certificate (EAP-TLS) or username/password (PEAP-MSCHAPv2)
• Use cases: All user traffic to corporate resources, file servers, intranet sites, corporate applications
• Configuration: Standard VPN profile deployed via Intune to the user
• Traffic: Can be full tunnel (all traffic through VPN) or split tunnel (only corporate traffic)

Design recommendation:

• Use Device Tunnel in restricted split-tunnel mode (routes only to DCs, SCCM servers, DNS)
• Use User Tunnel with certificate authentication (EAP-TLS with user certificate)
• Split-tunnel User Tunnel for performance: route only corporate subnets through VPN, allow internet traffic direct
• Enable traffic filters on the Device Tunnel to limit what the pre-logon connection can reach

AOVPN requires a Windows Server with the Remote Access role (RRAS) as the VPN endpoint, and an NPS (Network Policy Server) for authentication.

Install Remote Access on the VPN server:

# Install Remote Access and NPS roles
Install-WindowsFeature DirectAccess-VPN, RRAS -IncludeManagementTools
Install-WindowsFeature NPAS -IncludeManagementTools

# Configure RRAS as a VPN server (not DirectAccess)
Install-RemoteAccess -VpnType VPN

# Configure RRAS to use a static address pool for VPN clients
# Or configure DHCP forwarding
Set-RemoteAccess -IPAddressAssignment StaticPool
Add-VpnIPAddressRange -IPAddressRangeStart '10.100.0.1' -IPAddressRangeEnd '10.100.0.254'

Required certificates on the RRAS server:

1. Server Authentication certificate: issued by your internal CA, Subject = the RRAS server FQDN, Enhanced Key Usage = Server Authentication. This is what VPN clients validate when connecting.
2. The certificate must be in the LocalMachine\My store on the RRAS server

Bind the certificate to IKEv2:

# Configure RRAS to use the correct certificate for IKEv2
$thumbprint = (Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.Subject -match 'vpn.domain.com' }).Thumbprint
Set-VpnAuthProtocol -RootCertificateNameToAccept $thumbprint -UserAuthProtocolAccepted Certificate, EAP

NPS configuration for EAP-TLS (certificate-based auth):

1. Open NPS > Policies > Connection Request Policies > create new
2. Conditions: Tunnel-Type = IKEv2, NAS-Port-Type = VPN
3. Settings: Authentication > Override network policy > EAP methods > add Microsoft: Smart Card or other certificate
4. Create Network Policy matching VPN connections: Authentication type = EAP-TLS
5. Specify the user/computer certificate CA for authentication

AOVPN profiles are deployed as XML configuration via Intune or Group Policy. The User Tunnel profile is deployed to the user; the Device Tunnel profile is deployed to the device.

Example User Tunnel ProfileXML:

<VPNProfile>
  <NativeProfile>
    <Servers>vpn.domain.com</Servers>
    <NativeProtocolType>IKEv2</NativeProtocolType>
    <Authentication>
      <UserMethod>Eap</UserMethod>
      <Eap>
        <Configuration>
          <!-- EAP-TLS configuration referencing user certificate -->
          <EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig">
            <EapMethod>
              <Type xmlns="http://www.microsoft.com/provisioning/EapCommonSchema">13</Type>
              <VendorId xmlns="http://www.microsoft.com/provisioning/EapCommonSchema">0</VendorId>
            </EapMethod>
          </EapHostConfig>
        </Configuration>
      </Eap>
    </Authentication>
    <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
    <DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
  </NativeProfile>
  <Route>
    <Address>10.0.0.0</Address>
    <PrefixSize>8</PrefixSize>
  </Route>
  <Route>
    <Address>172.16.0.0</Address>
    <PrefixSize>12</PrefixSize>
  </Route>
  <DnsSuffix>domain.com</DnsSuffix>
  <TrustedNetworkDetection>domain.com</TrustedNetworkDetection>
  <!-- TrustedNetworkDetection: do not connect when on corporate network -->
  <AlwaysOn>true</AlwaysOn>
  <RememberCredentials>true</RememberCredentials>
  <RegisterDNS>true</RegisterDNS>
</VPNProfile>

Deploy via Intune: Intune > Devices > Configuration profiles > Create profile > Windows 10 and later > Templates > VPN

• Connection type: IKEv2
• Or use Custom OMA-URI to deploy raw ProfileXML:
  • OMA-URI: ./Device/Vendor/MSFT/VPNv2/<ProfileName>/ProfileXML
  • Data type: String
  • Value: (paste your ProfileXML, properly escaped)

AOVPN requires certificates from an internal CA. Minimum requirements:

For the User Tunnel (user certificate):

• Certificate template: duplicate the built-in 'User' template
• Subject: User Principal Name (UPN) of the authenticating user
• Enhanced Key Usage: Client Authentication
• Auto-enroll: enabled via Group Policy or Intune SCEP profile

For the Device Tunnel (machine certificate):

• Certificate template: duplicate the built-in 'Computer' template
• Subject: DNS name of the machine (FQDN)
• Enhanced Key Usage: Client Authentication
• Auto-enroll: enabled on all devices via Group Policy or Intune SCEP

For the RRAS server (server certificate):

• Subject: FQDN of the VPN server endpoint (what clients connect to)
• Enhanced Key Usage: Server Authentication
• Auto-enroll or manual issuance from internal CA

Configure auto-enrollment via Group Policy:

Computer Configuration > Windows Settings > Security Settings > Public Key Policies
> Certificate Services Client - Auto-Enrollment Settings: Enabled
  Renew expired certificates, update pending certificates, remove revoked certificates: Enabled
  Update certificates that use certificate templates: Enabled

User Configuration > Windows Settings > Security Settings > Public Key Policies
> Same settings for user certificates

OCSP or CRL for certificate revocation: The RRAS server and NPS must be able to validate whether user/machine certificates have been revoked. Configure either:

• CRL Distribution Point (CDP) accessible from both corporate network and internet (for remote devices to check before connecting)
• OCSP responder (faster, more reliable for remote clients)

If a device is lost or stolen, revoke the machine certificate -- the device cannot establish a Device Tunnel connection once the certificate is revoked.