ASA Windows7 and Start-Before-logon (SBL) Issues

[Jim Bell]

We are attempting unsuccessfully to get Windows7 SBL working with the following configuration (SBL works for XP);

ASA5520

ASA 8.0(4)

ASDM 6.1(5)

AnyConnect 2.4.1012

License VPN Plus (SSL VPN Peers 100)

When configuring Group Policy for Optional Clent Module to download we only have option for vpngina and cannot see Start Before Logon (SBL) module as referenced in AnyConnect Client 2.4 documentation.

Is this a license type issue or do we need an upgrade to ASA/ASDM software ?

Thanks in advance for your help.

[Robert Salazar]

You can use vpngina for the same purpose.

I believe the command has changed in later versions from vpngina to Start Before Login to be more intuitive.

Let me know if you have any further questions regarding this.

[Jim Bell]

Thanks Rosalaza,

We have our Group policy set for vpngina and SBL set to True in the profile and did see an AnyConnect SBL module downloaded.

However on rebooting the Windows7 laptops - after Switch User selected - we do not see the Network Connect button (in lower-right corner of window) to launch AnyConnect Client.

[Robert Salazar]

You may want to check if the profile has been pushed to that pc:

   C:\ProgramData\Cisco\Cisco AnyConnect VPN Client\Profile

If the profile is loaded in that directory, what icons do you see at the bottom right hand corner?

-Rob

[Jim Bell]

Thanks Rob,

Looks like the issue, I can't see the profile in that location.

Will work through the document in link you gave me to see if it resolves my issue, and post results back here.

[Robert Salazar · Accepted solution]

The following doc can be referenced regarding the rest of the SBL setup:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809f0d75.shtml

[Jim Bell]

Thanks Rob,

Now have SBL working for Windows7 - just some dns issues to resolve now.