Configure Always On VPN before Windows Logon

This section captures the details to configure Always On VPN before Windows Logon by using an advanced policy.

Prerequisites

• NetScaler Gateway and VPN plug-in must be version 13.0.41.20 and later.
• NetScaler Advanced Edition and higher is required for the solution to work.
• You can configure the functionality only by using advanced policies.
• The VPN virtual server must be up and running.

High-level configuration steps

The Always On VPN before Windows Logon configuration involves the following high-level steps:

1. Set up a machine level tunnel
2. Set up a user level tunnel (optional)
3. Enable user authentication
   1. Configure the VPN virtual server, install a CA certificate, and bind the certificate key to the virtual server.
   2. Create an authentication profile
   3. Create an authentication virtual server
   4. Create authentication policies
   5. Bind the policies to the authentication profile

Machine level tunnel

Machine level tunnel is established towards NetScaler Gateway using the device certificate as identity. Device certificate must be installed in the client machine under the machine store. This is applicable only for Always On before Windows Logon service.

For more details on device certificate, see Use device certificates for authentication.

Important:

If the VPN virtual server on the NetScaler Gateway appliance is configured on a nonstandard port (other than 443), the machine-level tunnel does not work as intended.

Set up machine level tunnel by using the device certificate

Device certificate based authentication configuration by using the GUI

1. On the Configuration tab, navigate to NetScaler Gateway > Virtual Servers.
2. On the NetScaler Gateway Virtual Servers page, select an existing virtual server and click Edit.

3. Under Certificate, click CA Certicicate.

4. On the CA Certificate Binding page, click Add next to the Select CA Certificate field, update the requires information, and click Install.

   

5. On the VPN Virtual Server page, click the edit icon.

6. In the Basic Settings section, click More.

7. Click Add next to the CA for Device Certificate section and click OK.

   

   Note: Do not select the Enable Device Certificate checkbox.

8. For binding a CA certificate to the virtual server, click CA certificate under Certificate section. Click Add Binding under the SSL Virtual Server CA Certificate Binding page.

   Note:

   • The device certificate’s subject common name (CN) field must not be empty. If a device tries to log in with empty CN device certificates, its VPN session is created with the user name as “anonymous”. In IIP, if multiple sessions have the same user name, previous sessions are disconnected. So, when IIP is enabled, you notice the functionality impact because of an empty common name.
   • All CA certificates (Root and Intermediate) that can potentially sign the Device Certificate issued to clients must be bound under the CA for Device Certificate section and also the CA Certificate binding section for virtual server in Steps 4 and 5. For more information on linking CA certificate with intermediate / subordinate, see Install, link, and update certificates.
   • If multiple device certificates are configured, the certificate with the longest expiry date is tried for the VPN connection. If this certificate allows the EPA scan successfully, then the VPN connection is established. If this certificate fails in the scan process, the next certificate is used. This process continues until all the certificates are tried.

9. On the CA Certificate Binding page, select the certificate.

10. Click Bind.

11. Create an authentication virtual server.
    1. On the VPN Virtual Servers page, navigate to Advanced Settings > Authentication Profile and click Add.
    2. On the Create Authentication Profile page, assign a name to the authentication profile, and click Create.
    3. On the Authentication Virtual Server page, assign a name to the authentication virtual server. Select the IP Address type as Non-Addressable, and click OK.

    Note:

    The authentication virtual server always remains in the DOWN state.

12. Create an authentication policy.
    1. In the Advanced Authentication Policies section of the Security > AAA-Application Traffic > Authentication Virtual Servers page, select the authentication policy and click Add Binding.
    2. On the Policy Binding page, click Add next to the Select Policy field.
    3. On the Create Authentication Policy page;
       1. Assign a name to the advanced authentication policy.
       2. Select EPA from the Action Type list.
       3. Click Add next to Action.
    4. On the Create Authentication EPA Action page;
       1. Assign a name to the EPA action.
       2. Enter sys.client_expr("device-cert_0_0") in the Expression field.

       3. Click Create.

          

13. On the Create Authentication Policy page;
    1. Assign a name to the authentication policy.
    2. Enter is_aoservice in the Expression field.

    3. Click Create.

       

14. On the Policy Binding page, enter 100 in Priority and click Bind.

Device certificate based authentication configuration by using the CLI

1. Install a CA certificate on a VPN virtual server.

   add ssl certkey ckp -cert t_CA.cer
   <!--NeedCopy-->
   

2. Bind the CA certificate to the VPN virtual server.

   bind ssl vserver <vServerName> -certkeyName <string> -ocspCheck ( Mandatory | Optional )
   <!--NeedCopy-->
   

   Example

   bind ssl vserver TestClient -CertkeyName ag51.xm.nsi.test.com -CA -ocspCheck Mandatory
   <!--NeedCopy-->
   

3. Add an authentication virtual server.

   add authentication authnProfile <name>  {-authnVsName <string>}
   <!--NeedCopy-->
   

   Example

   add authentication authnProfile always_on -authnVsName always_on_auth_server
   <!--NeedCopy-->
   

4. Create an authentication EPA action.

   add authentication epaAction <name> -csecexpr <expression>
   <!--NeedCopy-->
   

   Example

   add authentication epaAction epa-act -csecexpr      `sys.client_expr("device-cert_0_0")` -defaultgroup epa_pass
   <!--NeedCopy-->
   

5. Create an authentication policy

   add authentication Policy <name> -rule <expression> -action <string>
   <!--NeedCopy-->
   

   Example:

   add authentication Policy always_on_epa_auth -rule is_aoservice -action epa_auth
   <!--NeedCopy-->
   

Important:

• The machine-level tunnel configuration is now complete. To set up the user-level tunnel after the Windows Logon, see the section User Level Tunnel.

• On the client machine, the device certificate is in the .pfx format. The .pfx certificate is installed on the Windows machine as Windows understand the .pfx format. This file has the certificate and key files. This certificate must be of the same domain which is bound to the virtual server. The .pfx and server certificates and keys can be generated by using the client certificate wizard. These certificates can be used with the certificate authority to generate the respective .pfx with server certificate and domain. The certificate .pfx is installed in the computer account in the personal folder. The show aaa session command displays the device tunnel on the NetScaler appliance.

User Level Tunnel

Replace a machine-level tunnel with a user-level tunnel by using the GUI

Note: The expression is_aoservice.not is applicable from NetScaler Gateway version 13.0.41.20 and later.

1. Configure a policy for user authentication.
   1. Navigate to NetScaler Gateway > Virtual Servers and select a virtual server.
   2. In Advanced Settings, click Authentication Profile.
   3. Configure the authentication profile.
   4. On the Configuration > Security > AAA-Application Traffic > Authentication Virtual Servers page, select the authentication policy.

   5. In Select Action, click Edit Binding and change GoTo Expression to NEXT instead of END for the policy bound.

      

      

   6. Click Bind and then in the Authentication Policy page, select the authentication policy and click Add binding.

      

   7. On the Policy Binding page, click Add next to Select Policy.

      On the Create Authentication Policy page;

      1. Enter a name for the “no authentication” policy to be created.
      2. Select action type as No_AUTHN.
      3. Enter is_aoservice.not in the Expression field.
      4. Click Create.

2. In Select Action, click Edit Binding.

   

3. On the Policy Binding page, enter 110 in Priority. Click Add next to Select Next Factor.
   1. On the Authentication Policy Label page, enter a descriptive name for the policy label, select the login schema, and click Continue.
   2. In Select Policy, click Add and create an LDAP authentication policy.
   3. Click Create, and then click Bind.
   4. Click Done, and then click Bind.

   In the Authentication Policy page, the Next Factor column displays the configured next factor policy.

   

4. You can configure LDAP policy as the next factor of authentication policy.
   1. On the Create Authentication Policy page, enter a name for the LDAP policy.
   2. Select Action Type as LDAP.
   3. Enter Action as configured LDAP action.

   Note:

   • For creating login schema XML file, see Login schema XML file.
   • For creating policy labels, see Authenticate the policy label.
   • For creating an LDAP authentication policy, see To configure LDAP authentication by using the configuration utility.

Replace a machine-level tunnel with a user-level tunnel by using the CLI

1. Bind a policy to the authentication virtual server

   bind authentication vserver <name> -policy <name> -priority  <positive_integer> -gotoPriorityExpression <expression>
   <!--NeedCopy-->
   

   Example

   bind authentication vserver alwayson-auth-vserver -policy alwayson-auth-pol -priority 100 -gotoPriorityExpression NEXT
   
   <!--NeedCopy-->
   

2. Add an authentication policy with the action as NO_AUTH and expression is_aoservice.not, and bind it to the policy.

   add authentication Policy <name> -rule <expression> -action <string>
   
   bind authentication vserver <name> -policy <name> -priority <positive_integer> -gotoPriorityExpression <expression>
   <!--NeedCopy-->
   

   Example

   add authentication Policy alwayson-usertunnel-pol -rule is_aoservice.not -action NO_AUTHN
   
   bind authentication vserver alwayson-auth-vserver -policy alwayson-usertunnel-pol -priority 110
   <!--NeedCopy-->
   

3. Add a next factor and bind the policy label to the next factor.

   add authentication policylabel <labelName> -loginSchema <string>
   
   bind authentication  policylabel <string>  -policyName <string>  -priority <positive_integer> -gotoPriorityExpression <expression> -nextFactor <string>
   <!--NeedCopy-->
   

   Example

   add authentication policylabel user-tunnel-auth-label -loginSchema singleauth_alwayson
   
   bind authentication policylabel user -policyName alwayson-usertunnel-pol -priority 100
   <!--NeedCopy-->
   

4. Configure an LDAP policy and bind it to the user tunnel policy label.

   
   add authentication policy <name>  -rule <expression>  -action <string>
   
   bind authentication vserver <vserver_name> -policy <string>  -priorit < positive integer>  gotoPriorityExpression <string>
   <!--NeedCopy-->
   

   Example

   add authentication Policy LDAP_new -rule true -action LDAP_new
   
   bind authentication policylabel user-tunnel-auth-label -policyName LDAP_new -priority 100 -gotoPriorityExpression NEXT
   <!--NeedCopy-->
   

Client side configuration

The AlwaysOn, locationDetection, and suffixList registries are optional and only required if the location detection functionality is needed.

To access registry key entries, navigate to the following path: Computer>HKEY_LOCAL_MACHINE>SOFTWARE>Citrix>Secure Access Client

For more information about these registry entries, see Always On.

Note:

When the Always On service is configured, the Always On profile configured on the NetScaler Gateway virtual server or on NetScaler is ignored on the client side. So, ensure that you also enable the locationDetection and AlwaysOn VPN registries when configuring the Always On service.