Configure the native Microsoft Windows client

Import the Certification Authority (CA) Certificate

On the Microsoft Windows client:

  1. In the search bar, type certificates and select Manage Computer Certificates.
    The certificate management console opens.
  2. Click Trusted Root Certification Authorities.
  3. Right-click Certificates in the right-hand window and select All Tasks > Import...
    The certificate import wizard starts.

    4. IMPORTANT
    Make sure that the selected Store location (certificate store) is Local Machine.

  4. Click on Next.
  5. Select the CA certificate used to sign the identities of users using the IPsec VPN. Example: CA-EAP-TLS.pem and click Next.
  6. For the Place all certificates in the following store step, leave the default selection Trusted Root Certification Authorities and click Next.
  7. Confirm the import by clicking Finish.
  8. Confirm the warning message by clicking Yes.
  9. Close the management console.

Import the user's certificate

On the Microsoft Windows client:

  1. In the search bar, type certificates and select Manage User Certificates.
    The certificate management console opens.
  2. Click Personal.
  3. Right-click Certificates in the right-hand window and select All Tasks > Import...
    The certificate import wizard starts.
  4. Make sure that the selected Store location (certificate store) is Current User.
  5. Click on Next.
  6. Select the user's certificate. Example: john.doe.p12 and click Next.
  7. Enter the password protecting the certificate and click Next.
  8. Place all certificates in the following store: leave the default selection Personal and click Next.
  9. Confirm the import by clicking Finish.

Set up Microsoft Windows VPN client

  1. In the search bar, type vpn and select VPN Settings.
    The VPN client management console opens.
  2. Click Add VPN.
  3. Fill in the following fields:
    • VPN provider: select Windows (built-in),
    • Connection name: enter a name. Example: vpn-eap-tls.
    • Server name or address: Specify the FQDN name or IP address of the firewall serving as the IPsec gateway. Example: vpneaptls.stormshield.eu.
    • VPN Type: Select IKEv2.
    • Type of sign-in info: select Certificate.
  4. Click Save.
    The VPN connection is added to the VPN management console.
  5. Expand the details of the newly added connection and click Advanced Options.
  6. In the More VPN Properties section, click Edit.
  7. Security tab: For the Data Encryption field, select Maximum strength encryption (disconnect if server declines).
  8. Security tab: for the Authentication > Use Extensible Authentication Protocol (EAP) field, select Microsoft: Smart card or other certificate (EAP-TLS) (encryption enabled) ... and click Properties.
  9. Clear the Connect to these servers (Examples: srv1; srv2; .*\.srv3\com) checkbox.
  10. Select the Trusted Root Certification Authorities. Example: CA-EAP-TLS.
  11. Click OK then OK to validate the configuration.
  12. Close the management console.