Showing results for 
Search instead for 
Did you mean: 
Post a Question

Start VPN tunnel before Windows Logon?

To start the tunnel BEFORE you login with domain-credtials to your windows pc.

Then, after the vpn tunnel is established, you can logon directly into your Active Directory domain

is it possible with Mobile access or IPsec vpn ?

5 Replies

Re: Start VPN tunnel before Windows Logon?

Definitely possible with Endpoint Security, check out the Secure Domain Logon (SDL) feature.  I don't believe it is possible with the MAB if you are just doing a bare-bones SNX tunnel, client-side software is required for SDL.

My book "Max Power: Check Point Firewall Performance Optimization"
now available via

"IPS Immersion Training" Self-paced Video Class
Now Available at

Re: Start VPN tunnel before Windows Logon?

Checkpoint Endpoint Security

Right click and go to "VPN Option"  Select  "Advanced"  

Enable Secure Domain Logon - Window login



DWORD   Value Name: SDLEnabled    Value Data: 1     Base Hexadecimal

0 Kudos

Re: Start VPN tunnel before Windows Logon?

Hello Dhansham ,

Thanks for the solution .We are looking for a way to present checkpoint at logon as a users choice , with the way you mentioned it to do comes up at logon but every time , even if a user is connected to corporate network via LAN , if these settings are configured , it will always pop up the Checkpoint window. Is there a known way to disable this behaviour , and to let it to user click the icon on logon screen and start it .

Any suggestion would be appreciated , we are testing this on windows 10 v1709.


Re: Start VPN tunnel before Windows Logon?


If ignore_sdl_in_encdomain is set to true (in the GW ttm file) the SDL window does not show when the client is inside the LAN or VPN domain.

Another solution you can use is machine authentication, this feature enables you to authenticate with a machine certificate and establish a VPN tunnel before the Windows Logon. The feature introduced in E80.71 and requires a hotfix on top of R77.30 jumbo 286. If you would like to read more information on this feature please refer to E80.71 (and above) Admin guide. 



Re: Start VPN tunnel before Windows Logon?


Thanks a lot for your quick response !!!

We have already Set ignore_sdl_in_encdomain as TRUE and it shows an ICON to

Connect to VPN that we need but when i am trying to login connecting LAN

cable to windows it still prompting for Checkpoint VPN credential and

everytime i need to cancle it to login with my Domain account without VPN.



On Mon, Apr 23, 2018 at 7:25 AM, Adi Babai <>

0 Kudos