Configure Always On VPN before Windows Logon using classic policy
Prerequisites
-
NetScaler Gateway and VPN plug-in must be version 12.0.51.24 and later
-
Using classic policy you can configure machine-level tunnel only. For user-level tunnel configuration, see [advanced policy config link]
Configure Always On VPN before Windows Logon by using classic policy in GUI
Always On VPN before Windows Logon supports the following two configurations:
- Device certificate authentication
- Client Certificate Authentication
Device certificate based authentication
- On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
- On the NetScaler Gateway Virtual Servers page, select an existing virtual server and click Edit.
- On the VPN Virtual Servers page, under Basic Settings section, click Edit.
- Clear the Enable Authentication box to disable authentication and enable device certificate by checking the Enable Device Certificate box.
-
Click Add to add available device certificate issuer’s CA certificate name to the list.
-
For binding a CA certificate to the virtual server, click CA certificate under Certificate section. Click Add Binding under the SSL Virtual Server CA Certificate Binding page.
-
Click
Click to selectto select the required certificate.
-
Select the required CA certificate.
-
Click Bind.
- Click OK to save the configuration.
Client Certificate based authentication
- On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
- On the NetScaler Gateway Virtual Servers page, select an existing virtual server and click Edit.
- In the navigation pane, under Authentication, click CERT.
- In the details pane, click Add.
- In the Name field, type a name for the policy.
- Click New next to the server.
- In Name, type a name for the profile.
- Select OFF next to Two Factor.
- In User Name and Group Name, select the values and then click Create.
- In the Create Authentication Policy dialog, next to Named Expressions, select the expression, click Add Expression, click Create, and then click Close.
- Bind the expression to the virtual server.
- On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
- On the NetScaler Gateway Virtual Servers page, select an existing virtual server and click Edit.
- In the configure NetScaler Gateway Virtual Server dialog box, click the Authentication tab.
- Click Primary and under Details, click Insert Policy.
- In Policy Name, select the policy and then click OK.
- On the VPN Virtual Servers page, create an SSL profile.
- In Deny SSL Renegotiation, select NONSECURE for non-secure requests only.
- Click OK.
Client side configuration
AlwaysOn, locationDetection, and suffixList registries are optional and only required if the location detection functionality is needed.
| Registry key | Registry type | Values and description |
|---|---|---|
| AlwaysOnService | REG_DWORD | 1 => Enable Always On service without a user persona; 2 => Enable Always On service with user persona |
| AlwayOnURL | REG SZ | URL of the NetScaler Gateway virtual server a user wants to connect to. Example: https://xyz.companyDomain.com
|
AlwaysOn |
REG_DWORD | 1 => Allow network access on VPN failure; 2=> Block network access on VPN failure |
| locationDetection | REG_DWORD | 1 => To enable location detection; 0 => To disable location detection |
| suffixList | REG SZ | Comma separated list of intranet domains. Used when location detection is enabled. |