Start before logon feature

[Xavier Lloyd]

Hi All,

I have a customer who wants to do start before logon Anyconnect VPN. I can't find anything about the user experience. Is it possible to make the whole process transparent to the end user so that they only have to login once to Windows and it will take those credentials to login to Anyconnect as well? Do I have to use certificates for authentication? Also, are there any gotchyas I need to be aware of?

[Javier Portuguez]

Hello Lloyd,

Please check this out:

ASA 8.X: AnyConnect Start Before Logon Feature Configuration

Things to keep in mind:

Move all the related certificates to the machine certificate store.

Let me know if you have any questions.

Thanks.

Portu.

Please rate this post if you find it helpful.

[Xavier Lloyd]

Hi Javier,

Thanks for the response! I had seen this document already but I realised that it didn't really give me a good idea of the user experience when it is implemented. Does the user have to log in twice or just once? Is the Anyconnect transparent and can I configure it to be completely hidden from the end user? I think I've seen the config somewhere but I can't find it.

Thanks much!

- Xavier

[Javier Portuguez · Accepted solution]

Xavier,

The user logs in normally, the client automatically downloads the Gina Module (SBL) and the XML profile with SBL option set to true (all this during the connection process).

So the user will not notice this process at all.

Keep me posted.

Portu.

Message was edited by: Javier Portuguez

[Xavier Lloyd]

Thanks for the info, I'm going to try to test this in house.

[Javier Portuguez]

Awesome, feel free me to ping me back at any time.

Have a good one.

Take care.

[Xavier Lloyd]

Hi Javier,

I configured the SBL feature and almost got it working. I think there's an issue with my certificate setup so once I resolve that I should be fine. One thing though...I was wondering if there's a way to connect the VPN without any user interaction at all. Currently, I'll still need to click the VPN connect button after I press ctrl+alt+del. Is there any way to configure it to connect automatically without the user having to do anything?

-Xavier

[Javier Portuguez]

Hi Xavier,

No, that combination is required.

Thanks.

Portu

[Xavier Lloyd]

Thanks. Now that I've configured it and tested fully, I think the automatic login on startup is the feature I actually need. Thanks for your help man