Best Practices Analyzer for Remote Access: Configuration (Section 1)

Applies To: Windows Server 2012 R2

The topics in this section can help you bring Remote Access running on Windows Server 2012 R2 into compliance with configuration best practices. Content in this section is most valuable when you have completed a Best Practices Analyzer scan of Remote Access and you want information about how to interpret and resolve scan results that identify areas of Remote Access that are noncompliant with configuration best practices.

Best Practices Analyzer and configuration rules

The Best Practices Analyzer applies configuration rules to identify settings that might require modification for Remote Access to perform optimally. Configuration rules can help prevent setting conflicts that can result in error messages or prevent Remote Access from carrying out its prescribed duties in an enterprise.

Topics in this section

This section includes the following topics.

• RRAS: The inbound Certification Authority (CA) should be configured

• RRAS: A valid CA certificate for the Remote Access Server certificate must be present in the TRCA certificate store

• RRAS: A valid CA certificate for the Site-to-Site VPN interface certificate must be present in the TRCA certificate store

• RRAS: The server certificate expires within 7 days

• RRAS: The CA certificate of the Remote Access Server certificate in the TRCA certificate store expires within 7 days

• RRAS: The certificate for the Site-to-Site VPN interface expires within 7 days

• RRAS: The CA certificate for the Site-to-Site VPN interface certificate expires within 7 days

• RRAS: The CA certificate for the destination server of Site-to-Site VPN interface expires within 7 days

• RRAS: The Remote Access server certificate must have a public IP address for Alternate Subject Name

• RRAS: The Site-to-Site VPN interface name must match the Username

• RRAS: No two Site-to-Site VPN interfaces with PSK based authentication should have the same destination

• RRAS: For PSK authentication, the destination cannot be configured as a Fully Qualified Domain Name (FQDN)

• RRAS: The Site-to-Site VPN interface should be configured with a Source IP address

• RRAS: Custom policies configured for the Site-to-Site VPN interface should be a subset of Remote Access server global policies

• RRAS: The number of ports available for the Routing Domain should not be less than the number of VPN and Site-to-Site VPN interfaces