topic Re: Endpoint client option in trac.defaults to start at windows login in SASE and Remote Access

Endpoint client option in trac.defaults to start at windows login

Peter_Dray — Fri, 07 Jul 2023 09:01:10 GMT

Working to implement machine tunnel VPN for remote access on gateway running R81.10 JHF Take 95, and clients are windows 10 using Endpoint Client E87.20. Our existing remote access currently uses SDL, but part of the work is to disable this as an option, but is there a setting in the trac.defaults file that will do the job to start the Endpoint client when they login, rather than after this has completed. Or would this need to be set via windows.

Re: Endpoint client option in trac.defaults to start at windows login

PhoneBoy — Fri, 07 Jul 2023 14:09:45 GMT

Without SDL, the VPN client will start when the user logs in.
This is the default behavior.

Re: Endpoint client option in trac.defaults to start at windows login

biskit — Sat, 08 Jul 2023 22:22:57 GMT

Do you mean you're trying to do a machine based VPN as the machine boots? Instead of waiting until after CTRL+ALT+DEL before establishing a user-login based VPN?

This is possible and there are a few options around whether the VPN stays logged in as the machine based even after Windows login, or whether it is machine based up until the Windows login, then it drops and prompts for user login credentials. You can also disable the ability for the user to disconnect, forcing them to stay on VPN permanently.

Machine based is good for people wishing to push down GPO updates etc. when they have a workforce that infrequently connects on the LAN.

Machine based uses AD machine certificates. So you need a CA on your AD, and all machines must have a machine certificate from your AD CA. You need the root cert from the CA installed on the firewall (similar to sk149253).

You possibly want sk121173. Although that it's the one I followed... I can't recall which one it was but I'll have a dig and let you know if I find it. The method I used also requires a tweak to set enable_machine_auth=false in trac.defaults (probably what you're alluding to?) on all client machines (so this needs some prior planning). I don't think that change can be pushed out centrally 🙄. I think this stuff is in the VPN Admin guide too - presume you've checked there?