This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos SSL VPN client start before windows login

Cisco AnyConnect clients we've been using on roaming AD domain-joined Windows computers have a start before logon (SBL) module and an option in each client config file to allow users to click a button on the Windows logon screen before signing into windows that pops up a Cisco AnyConnect login prompt. They can sign into the vpn from there and then sign into windows after that completes. This automatically keeps cached credentials within the user's windows profile up to date for anything requiring single sign on / kerberos and also automatically keeps locally cached credentials in sync with the AD domain credentials, allows latest group policies to be applied at time of logon, and can handle AD password expirations through options configured on a Cisco firewall. Is there a way to configure vpn start before logon with Sophos SSL VPN 2.1 clients + XG210_WP03_SFOS 17.1.1 MR-1?

This thread was automatically locked due to age.

Parents

0 LuCar Toni over 7 years ago

Hi,

There was (is) an old way to build this, but i would not recommend to do it.

https://networkguy.de/?p=1086

https://www.avanet.com/kb/sophos-ssl-vpn-client-im-autostart-mit-auto-login/

As you can see, you have to store your windows password in a file on the hard drive.

Maybe you can try some IPsec Clients like NCP, they have the same kind of connection before windows logon.
Cancel
Vote Up 0 Vote Down

Cancel
0 onward over 7 years ago in reply to LuCar Toni

Thanks for the feedback. I read over something with a similar angle @ https://github.com/OpenVPN/openvpn-gui/issues/77

Having passwords either for user's AD account or a generic service account for the computer itself managed in a text file isn't ideal so I get why you wouldn't recommend it. Roaming pc's connected to vpn 24/7 when powered on even when user doesn't require vpn to be initiated is probably not ideal either in our case. I now see I'm not the only one looking for this functionality [:(]

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/20494468-ssl-vpn-before-authentication

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/11195724-ssl-vpn-client-that-logs-on-before-windows

Ideally we would stick with the Sophos vpn solution and scale well when targeting a few hundred users. Wondering what sort of windows / gina trickery it might take to throw the sophos vpn client logon prompt up in front of the windows user logon box if Sophos hasn't figured it out yet.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 onward over 7 years ago in reply to LuCar Toni

Thanks for the feedback. I read over something with a similar angle @ https://github.com/OpenVPN/openvpn-gui/issues/77

Having passwords either for user's AD account or a generic service account for the computer itself managed in a text file isn't ideal so I get why you wouldn't recommend it. Roaming pc's connected to vpn 24/7 when powered on even when user doesn't require vpn to be initiated is probably not ideal either in our case. I now see I'm not the only one looking for this functionality [:(]

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/20494468-ssl-vpn-before-authentication

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/11195724-ssl-vpn-client-that-logs-on-before-windows

Ideally we would stick with the Sophos vpn solution and scale well when targeting a few hundred users. Wondering what sort of windows / gina trickery it might take to throw the sophos vpn client logon prompt up in front of the windows user logon box if Sophos hasn't figured it out yet.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data