topic Re: VPN Login Before Windows in SASE and Remote Access

VPN Login Before Windows

sean37 — Tue, 22 Apr 2025 17:02:31 GMT

Issues - Not getting VPN Icon berfore windows login. This is a new Windows Deployment using Autopilot. End user has never logged into computer before this. Need to have VPN for first login when user is remote. The deployment type is hybrid entra. This requires user to authenicate to the DC.

I Can confirm that

1. Checkpint is install and trac.config is there with SDL enable and Always connect turned on

2. It does have Username and Password ad auth type.

3. Default site id configured.

Even with all this we still don't get the VPN icon on first boot after autopilot.

Re: VPN Login Before Windows

PhoneBoy — Tue, 22 Apr 2025 20:32:15 GMT

What authentication type have you configured for Remote Access?
If it's SAML, this does not support SDL, which is noted here:
https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/SAML-Support-for-Remote-Access-VPN.htm

Re: VPN Login Before Windows

sean37 — Tue, 22 Apr 2025 20:36:17 GMT

Using Username / Password and still cannot get the icon on the login to connect VPN

Re: VPN Login Before Windows

PhoneBoy — Tue, 22 Apr 2025 20:54:46 GMT

Please provide screenshots (with sensitive details redacted) showing what you've configured as well as the version/JHF levels of gateways and management.
Also, I don't know what "still cannot get the icon on the login to connect VPN" means, please show a screenshot of that.

Re: VPN Login Before Windows

the_rock — Tue, 22 Apr 2025 20:57:15 GMT

Did you follow below?

Andy

https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/SDL-for-SmartConsole-Managed-Clients.htm?tocpath=Configuring%20Client%20Features%7CSecure%20Domain%20Logon%20(SDL)%7C_____2

Re: VPN Login Before Windows

sean37 — Tue, 22 Apr 2025 21:19:23 GMT

Endpoint version E88.70
Gateways 1575 R81.10.15 x4 Cloud GW R82 98
SmartCloud R82 MGMT

Re: VPN Login Before Windows

PhoneBoy — Tue, 22 Apr 2025 23:59:42 GMT

Secure Domain Login leverages a legacy feature in Windows called GINA, which has technically been deprecated since Windows Vista.
I'm guessing the login method you are using (PIN) does NOT leverage GINA and/or your release of Windows completely disables GINA.

Regardless of the reason, no GINA means no SDL.

Re: VPN Login Before Windows

the_rock — Wed, 23 Apr 2025 00:01:37 GMT

Those settings look right to me...so what happens when laptop boots up? Do you see an option to try log in?

Andy

Re: VPN Login Before Windows

sean37 — Wed, 23 Apr 2025 00:05:26 GMT

No the VPN icon to try login. Never promots or anything.

Re: VPN Login Before Windows

sean37 — Wed, 23 Apr 2025 00:18:46 GMT

One other thing is that at this point of trying to login into the VPN no user has logged into the computer yet. It's a fresh OBE for the user using autopilot.

Re: VPN Login Before Windows

the_rock — Wed, 23 Apr 2025 03:09:57 GMT

Technically, it would not come up automatically, user would need to click on the icon when screen is locked before they enter their creds for windows.

Andy

Re: VPN Login Before Windows

sean37 — Wed, 23 Apr 2025 04:07:55 GMT

The problem is the icon does not show to click on. That is the part we’re missing.

Re: VPN Login Before Windows

the_rock — Wed, 23 Apr 2025 12:06:20 GMT

K, got it now. Here is what I would try...either reinstall the client on PC you are testing or try another one. If both fail, might be worth do remote with TAC.

Andy