Configure Always On VPN before Windows Logon

This section captures the details to configure Always On VPN before Windows Logon by using an advanced policy.


  • NetScaler Gateway and VPN plug-in must be version and later.
  • NetScaler Advanced Edition and higher is required for the solution to work.
  • You can configure the functionality only by using advanced policies.
  • The VPN virtual server must be up and running.

High-level configuration steps

The Always On VPN before Windows Logon configuration involves the following high-level steps:

  1. Set up a machine level tunnel
  2. Set up a user level tunnel (optional)
  3. Enable user authentication
    1. Configure the VPN virtual server, install a CA certificate, and bind the certificate key to the virtual server.
    2. Create an authentication profile
    3. Create an authentication virtual server
    4. Create authentication policies
    5. Bind the policies to the authentication profile

Machine level tunnel

Machine level tunnel is established towards NetScaler Gateway using the device certificate as identity. Device certificate must be installed in the client machine under the machine store. This is applicable only for Always On before Windows Logon service.

For more details on device certificate, see Use device certificates for authentication.


If the VPN virtual server on the NetScaler Gateway appliance is configured on a nonstandard port (other than 443), the machine-level tunnel does not work as intended.

Set up machine level tunnel by using the device certificate

Device certificate based authentication configuration by using the GUI

  1. On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
  2. On the NetScaler Gateway Virtual Servers page, select an existing virtual server and click Edit.
  3. Under Certificate, click CA Certicicate.

  4. On the CA Certificate Binding page, click Add next to the Select CA Certificate field, update the requires information, and click Install.

    Install CA certificate

  5. On the VPN Virtual Server page, click the edit icon.

  6. In the Basic Settings section, click More.

  7. Click Add next to the CA for Device Certificate section and click OK.

    Add ca for device certificate

    Note: Do not select the Enable Device Certificate checkbox.

  8. For binding a CA certificate to the virtual server, click CA certificate under Certificate section. Click Add Binding under the SSL Virtual Server CA Certificate Binding page.


    • The device certificate’s subject common name (CN) field must not be empty. If a device tries to log in with empty CN device certificates, its VPN session is created with the user name as “anonymous”. In IIP, if multiple sessions have the same user name, previous sessions are disconnected. So, when IIP is enabled, you notice the functionality impact because of an empty common name.
    • All CA certificates (Root and Intermediate) that can potentially sign the Device Certificate issued to clients must be bound under the CA for Device Certificate section and also the CA Certificate binding section for virtual server in Steps 4 and 5. For more information on linking CA certificate with intermediate / subordinate, see Install, link, and update certificates.
    • If multiple device certificates are configured, the certificate with the longest expiry date is tried for the VPN connection. If this certificate allows the EPA scan successfully, then the VPN connection is established. If this certificate fails in the scan process, the next certificate is used. This process continues until all the certificates are tried.
  9. On the CA Certificate Binding page, select the certificate.

  10. Click Bind.

  11. Create an authentication virtual server.
    1. On the VPN Virtual Servers page, navigate to Advanced Settings > Authentication Profile and click Add.
    2. On the Create Authentication Profile page, assign a name to the authentication profile, and click Create. Create an authentication profile
    3. On the Authentication Virtual Server page, assign a name to the authentication virtual server. Select the IP Address type as Non-Addressable, and click OK. Select nonaddressable IP type


    The authentication virtual server always remains in the DOWN state.

  12. Create an authentication policy.
    1. In the Advanced Authentication Policies section of the Security > AAA-Application Traffic > Authentication Virtual Servers page, select the authentication policy and click Add Binding.
    2. On the Policy Binding page, click Add next to the Select Policy field.
    3. On the Create Authentication Policy page;
      1. Assign a name to the advanced authentication policy.
      2. Select EPA from the Action Type list.
      3. Click Add next to Action. Select EPA action type
    4. On the Create Authentication EPA Action page;
      1. Assign a name to the EPA action.
      2. Enter sys.client_expr("device-cert_0_0") in the Expression field.
      3. Click Create.

        Create expression

  13. On the Create Authentication Policy page;
    1. Assign a name to the authentication policy.
    2. Enter is_aoservice in the Expression field.
    3. Click Create.

      Create expression2

  14. On the Policy Binding page, enter 100 in Priority and click Bind.

Device certificate based authentication configuration by using the CLI

  1. Install a CA certificate on a VPN virtual server.

    add ssl certkey ckp -cert t_CA.cer
  2. Bind the CA certificate to the VPN virtual server.

    bind ssl vserver <vServerName> -certkeyName <string> -ocspCheck ( Mandatory | Optional )


    bind ssl vserver TestClient -CertkeyName -CA -ocspCheck Mandatory
  3. Add an authentication virtual server.

    add authentication authnProfile <name>  {-authnVsName <string>}


    add authentication authnProfile always_on -authnVsName always_on_auth_server
  4. Create an authentication EPA action.

    add authentication epaAction <name> -csecexpr <expression>


    add authentication epaAction epa-act -csecexpr      `sys.client_expr("device-cert_0_0")` -defaultgroup epa_pass
  5. Create an authentication policy

    add authentication Policy <name> -rule <expression> -action <string>


    add authentication Policy always_on_epa_auth -rule is_aoservice -action epa_auth


  • The machine-level tunnel configuration is now complete. To set up the user-level tunnel after the Windows Logon, see the section User Level Tunnel.

  • On the client machine, the device certificate is in the .pfx format. The .pfx certificate is installed on the Windows machine as Windows understand the .pfx format. This file has the certificate and key files. This certificate must be of the same domain which is bound to the virtual server. The .pfx and server certificates and keys can be generated by using the client certificate wizard. These certificates can be used with the certificate authority to generate the respective .pfx with server certificate and domain. The certificate .pfx is installed in the computer account in the personal folder. The show aaa session command displays the device tunnel on the NetScaler appliance.

User Level Tunnel

Replace a machine-level tunnel with a user-level tunnel by using the GUI

Note: The expression is_aoservice.not is applicable from NetScaler Gateway version and later.

  1. Configure a policy for user authentication.
    1. Navigate to NetScaler Gateway > Virtual Servers and select a virtual server.
    2. In Advanced Settings, click Authentication Profile.
    3. Configure the authentication profile.
    4. On the Configuration > Security > AAA-Application Traffic > Authentication Virtual Servers page, select the authentication policy.
    5. In Select Action, click Edit Binding and change GoTo Expression to NEXT instead of END for the policy bound.

      Bind policy

      Bind policy

    6. Click Bind and then in the Authentication Policy page, select the authentication policy and click Add binding.

      Bind policy2

    7. On the Policy Binding page, click Add next to Select Policy.

      On the Create Authentication Policy page;

      1. Enter a name for the “no authentication” policy to be created.
      2. Select action type as No_AUTHN.
      3. Enter is_aoservice.not in the Expression field.
      4. Click Create. `No-auth-policy`
  2. In Select Action, click Edit Binding.


  3. On the Policy Binding page, enter 110 in Priority. Click Add next to Select Next Factor.
    1. On the Authentication Policy Label page, enter a descriptive name for the policy label, select the login schema, and click Continue.
    2. In Select Policy, click Add and create an LDAP authentication policy.
    3. Click Create, and then click Bind.
    4. Click Done, and then click Bind.

    In the Authentication Policy page, the Next Factor column displays the configured next factor policy.


  4. You can configure LDAP policy as the next factor of authentication policy.
    1. On the Create Authentication Policy page, enter a name for the LDAP policy.
    2. Select Action Type as LDAP.
    3. Enter Action as configured LDAP action.


Replace a machine-level tunnel with a user-level tunnel by using the CLI

  1. Bind a policy to the authentication virtual server

    bind authentication vserver <name> -policy <name> -priority  <positive_integer> -gotoPriorityExpression <expression>


    bind authentication vserver alwayson-auth-vserver -policy alwayson-auth-pol -priority 100 -gotoPriorityExpression NEXT
  2. Add an authentication policy with the action as NO_AUTH and expression is_aoservice.not, and bind it to the policy.

    add authentication Policy <name> -rule <expression> -action <string>
    bind authentication vserver <name> -policy <name> -priority <positive_integer> -gotoPriorityExpression <expression>


    add authentication Policy alwayson-usertunnel-pol -rule is_aoservice.not -action NO_AUTHN
    bind authentication vserver alwayson-auth-vserver -policy alwayson-usertunnel-pol -priority 110
  3. Add a next factor and bind the policy label to the next factor.

    add authentication policylabel <labelName> -loginSchema <string>
    bind authentication  policylabel <string>  -policyName <string>  -priority <positive_integer> -gotoPriorityExpression <expression> -nextFactor <string>


    add authentication policylabel user-tunnel-auth-label -loginSchema singleauth_alwayson
    bind authentication policylabel user -policyName alwayson-usertunnel-pol -priority 100
  4. Configure an LDAP policy and bind it to the user tunnel policy label.

    add authentication policy <name>  -rule <expression>  -action <string>
    bind authentication vserver <vserver_name> -policy <string>  -priorit < positive integer>  gotoPriorityExpression <string>


    add authentication Policy LDAP_new -rule true -action LDAP_new
    bind authentication policylabel user-tunnel-auth-label -policyName LDAP_new -priority 100 -gotoPriorityExpression NEXT

Client side configuration

The AlwaysOn, locationDetection, and suffixList registries are optional and only required if the location detection functionality is needed.

To access registry key entries, navigate to the following path: Computer>HKEY_LOCAL_MACHINE>SOFTWARE>Citrix>Secure Access Client

Registry key Registry type Values and description
AlwaysOnService REG_DWORD 1 => Establish machine level tunnel but not user level tunnel; 2 => Establish machine level tunnel and user level tunnel
AlwaysOnURL REG SZ URL of the NetScaler Gateway virtual server the user wants to connect to. Example: Important: Only one URL is responsible for machine level tunnel and user-level tunnel. The AlwaysOnURL registry helps both the service and user-level component to work and connect a separate tunnel, that is, machine-level tunnel and user-level tunnel based on the design
AlwaysOn REG_DWORD 1 => Allow network access on VPN failure; 2=> Block network access on VPN failure
AlwaysOnAllowlist REG_SZ Semi-colon separated list of IP addresses or FQDNs which must be whitelisted while the machine is running under the strict mode. Example:;
UserCertCAList REG_SZ Comma or semi-colon separated list of root CA names, that is the issuer name of the certificate. Used in the context of an Always On service where a customer can specify the list of CAs to choose the client certificate from. Example:;
locationDetection REG_DWORD 1 => To enable the location detection; 0 => To disable the location detection
suffixList REG SZ Semicolon separated list of domains and is responsible for checking if the machine is in intranet or not at any given time when location-detection is enabled. Example:,

For more information about these registry entries, see Always On.


When the Always On service is configured, the Always On profile configured on the NetScaler Gateway virtual server or on NetScaler is ignored on the client side. So, ensure that you also enable the locationDetection and AlwaysOn VPN registries when configuring the Always On service.

Configure Always On VPN before Windows Logon