topic Re: AD user should connect to RA VPN automatically in SASE and Remote Access

AD user should connect to RA VPN automatically

naveda — Tue, 24 May 2022 14:23:13 GMT

I have a query when RA VPN users log in to the system with AD credentials, they also should get connected to VPN automatically. The client should not ask them to put a username and password to connect to VPN same AD credentials should be used.

Is there a way to achieve this with AD username and passwords or is any other way which can work?

I tried enabling password caching and connect mode to always but that is also not working.

Re: AD user should connect to RA VPN automatically

naveda — Tue, 24 May 2022 14:24:08 GMT

@PhoneBoy could you please guide me on this?

Re: AD user should connect to RA VPN automatically

PhoneBoy — Tue, 24 May 2022 19:24:28 GMT

Secure Domain Login can bring up the VPN when the user logs in, but this requires credentials to be entered.
Certificates could be used for the VPN portion of the authentication in this case, particularly ones stored in the Windows Certificate Store (particularly one that cannot be exported).

Re: AD user should connect to RA VPN automatically

the_rock — Tue, 24 May 2022 19:28:23 GMT

I have client where this works perfectly fine. Just as a test, can you have them delete/re-create the site?

Re: AD user should connect to RA VPN automatically

naveda — Tue, 24 May 2022 20:26:28 GMT

@PhoneBoy Thanks for the response, could you please clarify which certificate I can use, in order to achieve the requirement.

Re: AD user should connect to RA VPN automatically

naveda — Tue, 24 May 2022 20:28:15 GMT

@the_rock I would like to know how it works perfectly fine. I tried to recreate the site but it's same.

Re: AD user should connect to RA VPN automatically

the_rock — Tue, 24 May 2022 22:44:33 GMT

I dont know what to tell you...we configured IA blade while ago, integrated with access roles and AD server and VPN works fine as auto connect/cashed creds.

Re: AD user should connect to RA VPN automatically

PhoneBoy — Thu, 26 May 2022 05:11:48 GMT

You can use any certs for this, including ones from the ICA.

Re: AD user should connect to RA VPN automatically

skandshus — Thu, 26 May 2022 10:16:48 GMT

is there a chance back in the day when you did it, you had to edit the trac to allow cached credentials in the VPN clients?
i even think it might be required to edit the trac file on the gateway to "allow it" and also edit it on the Endpoint client.

Re: AD user should connect to RA VPN automatically

naveda — Tue, 31 May 2022 12:12:09 GMT

@PhoneBoy Could you please confirm if we can go with CAPI certificate?

Re: AD user should connect to RA VPN automatically

the_rock — Tue, 31 May 2022 12:13:51 GMT

Yes, we did do that on both, correct.

Re: AD user should connect to RA VPN automatically

naveda — Tue, 31 May 2022 12:26:46 GMT

@skandshus @the_rock What I have to edit? I don't see anything related to password caching trac.ttm file

Re: AD user should connect to RA VPN automatically

the_rock — Tue, 31 May 2022 12:55:30 GMT

If you send me the files, I can check, but its been some time, so cant remember now.

Re: AD user should connect to RA VPN automatically

naveda — Tue, 31 May 2022 13:18:19 GMT

Re: AD user should connect to RA VPN automatically

the_rock — Tue, 31 May 2022 13:24:29 GMT

I think we may have changed default auth method to username-password.

Re: AD user should connect to RA VPN automatically

PhoneBoy — Tue, 31 May 2022 13:53:11 GMT

I don’t see why not.