Configure Pre-Logon for the Versa SASE Client

Last updated
Save as PDF

For supported software information, click here.

Pre-logon simplifies remote employee onboarding and device provisioning by ensuring that users can securely access critical enterprise resources before logging in. If your organization uses Active Directory (AD) on-premises, connectivity between the user device and AD is required when a user logs in for the first time. Pre-logon authenticates the user and establishes a secure connection to the organization’s network. When you enable pre-logon, a new user who has no connectivity to Active Directory can log in to the network the first time, because they can log in using the SASE client and the login credentials provided by the network administrator.

This enables:

First time laptop deployment to remote users where the device is shipped to an employee who has never connected to the corporate network.
Remote onboarding of new employees who need access to domain services, DNS, DHCP, security updates, or endpoint management systems before they can successfully log in.
Always-on secure access deployments that require network connectivity prior to user authentication.

The pre-logon connection method for a Versa SASE client allows a client device to establish a secure connection to an organization's network. Pre-logon authenticates a user on the client device and then establishes a VPN connection to the network.

To use pre-logon authentication, you must do the following before you ship a laptop device to a new enterprise user:

Install the SASE client with pre-logon enabled.
Install the necessary OS updates and security patches to meet the security requirements of your organization.

Then, the new user is able to log in to and access the organization's internal resources when they log in for the first time, regardless of where they log in from.

To allow endpoints to access resources in the network, you must create security policies that match the pre-logon user. These policies must allow access only to basic services such as DHCP, DNS, Active Directory, and antivirus.

This article describes the following:

Enabling pre-logon for a tenant.
Creating a device certificate-based authentication profile and enabling pre-logon device authentication.
Creating a client-based access policy rule.
Downloading the JSON file for that rule and manually editing it.
Creating a private app protection access policy rule to allow communication to internal services.
Enabling pre-logon on the SASE client.

Enable Pre-Logon for a Tenant

To enable pre-logon for a SASE tenant:

On the Tenants dashboard, click + Tenant to add a new tenant, or click the Edit icon to edit an existing tenant.
In the Create (or Edit) Tenant screen, select step 3, Security Service Edge (Product & Gateways). For more information, see Configure SASE Tenants.
In the Select Usage Type section, click the Pre-logon Enabled toggle to enable pre-logon for SASE clients of the tenant.
For information about configuring other parameters, see Configure SASE Tenants.
Click Skip to Review, or select step 7, Review & Submit.
Review and submit your tenant.

Configure a Device or User Certificate Authentication Profile

To configure the authentication profile for pre-logon:

In Tenant view, select Configure > Security Service Edge > User and Device Authentication > Profiles. The following screen displays.
Click + Add, or click Add User and Device Authentication Profiles if there are no existing profiles (as shown in the screenshot above). The Add User and Device Authentication Profiles window displays.
Select Device Certificate or User Certificate (here, Device Certificate).
Click Get Started. The workflow to add a user and device authentication profile displays, beginning with step 1, Settings.
Click the Client CA Chain field and select an uploaded CA chain certificate, or select + Create New to upload a CA chain certificate. The certificate must be Base64-encoded (.crt, .cer, or .pem) and validate the identity of the device certificate during authentication. The CA chain must include the entire certificate chain (end-to-end), including all intermediate CAs up to the root CA, and not only the immediate issuing CA.
Click the Username Identifying Field in Certificate field and select one of the following options: Subject Common-name, Subject-alternative-name email, or Subject-alternative-name principal name.
Click Next or select step 2, Authentication Order. The following screen displays.
Click the Enable Prelogon toggle under Pre-logon Device Authentication to allow the device to authenticate using device certificate authentication in pre-logon mode.
For information about configuring other parameters, see Configure User and Device Authentication Profiles.
Click Next, enter a name for the profile, and then click Save.

Configure a Client-Based Access Policy Rule

To create a client-based access policy rule required for pre-logon:

In Tenant view, select Configure > Secure Services Edge > Secure Access > Client-based Access > Policy Rules.
Click + Add. The workflow to create a client-based access rule displays.
In step 1, Operating System, select the operating system (here, Windows XP).
Select step 5, Traffic Action, and then select Allow to send all traffic that matches the rule to pass.
In the Allow section, select Send Apps to Versa Cloud Gateway to configure full-tunnel mode.

Note: In full-tunnel mode, only explicitly permitted services are reachable. If you use SAML user authentication, ensure that SAML traffic is not blocked by the access policy on the Versa Cloud Gateway (VCG).
Select step 6, Gateway. In this example, we associate a dedicated pre-logon client IP address pool to each gateway. Using separate pools for pre-logon and post-logon tunnels allows you to differentiate between the two sessions and use the source IP pool as a match criterion in access policies to enforce restricted access.
Select step 7, Client Configuration, and then select the appropriate Client Profile that contains the DNS server and routes required to resolve internal domain names.
For information about configuring other parameters, see Configure SASE Secure Client-Based Access Rules.
Click Skip to Review, enter a name for the rule (here, Windows-Prelogon_Profile-01), and click Save.
When prompted to configure the rule order, select Process the rule last (add this rule at the bottom of the rule list). This ensures the rule is not matched during portal registration.

Download and Edit the Default Pre-Logon File

The Secure Client Access Policy Rule List screen provides the option to download a sample JSON file, which includes the pre-logon parameters. You must transfer this file to all user devices that use the SASE client on which you configure pre-logon.

Note: The Pre-Logon Configuration column only appears if you have enabled pre-logon in the tenant configuration as described in Enable Pre-Logon from Concerto, above.

To download the default pre-logon JSON file:

In Tenant view, select Configure > Secure Service Edge > Secure Access > Client-based Access > Policy Rules.
From the list of rules, click Download JSON file under the Pre-Logon Configuration column.

The following table describes the fields in the default pre-logon JSON file provided by Versa Networks.

Field	Description
PrelogonControl (Group of Fields)
PrelogonDisconnectOnConnect	When enabled (set to true), tunnels that are established in pre-logon mode are disconnected when a user connects to a gateway using the SASE client after logging in to the device. Values: False, True Default: False
AutoPrelogonDisconnectTimeoutMins	Duration, in minutes, for which the pre-logon tunnel is available. If you enable PrelogonDisconnectOnConnect, the tunnel is disconnected as soon as the user connects, even if the AutoPrelogonDisconnectTimeoutMins time has not elapsed. If the user remains on the locked screen, the tunnel stays connected indefinitely until the user logs in. Default: 60 minutes
PrelogonCertOnlyAuth	When enabled (set to true), pre-logon supports only Device Certificate Method for authentication. You must set this field to true to enable always-on in pre-logon mode.
Enterprises (Group of Fields)
EnterpriseName	Name of the tenant or enterprise.
VPNRegisterAddress	The fully qualified domain name (FQDN) or IP address of the VPN gateway or server to which the SASE client registers to establish pre-logon connection. This is the primary endpoint the client connects to before authenticating the user.
AppControl
AlwaysOn	Specify if the VPN tunnel must always remain active: False—Always On is disabled, allowing the user to disconnect voluntarily. True—The client enforces Always On connection and blocks traffic if the VPN drops. Default: False
EIPAgentConfig (Group of Fields)
Requested	Enable (set to true) to have an endpoint information profile (EIP) check requested during the connection process, and to have the client initiate a posture assessment. Default: True
Opswat	Enable (set to true) to use the OPSWAT security compliance SDK/agent for EIP evaluation. Default: False
RealTimeRequiredSoftware	Enable (set to true) to enforce required software checks, such as antivirus and firewall, in real time during the session. Default: False
UserData	User-specific information used during authentication or session establishment.
Username	User name for the session. If you do not specify the user name, "prelogon" is used. Default: prelogon
GatewayProfiles (Group of Fields)	List of gateways associated with the enterprise or tenant. To obtain the values for the parameters GatewayProfileName, IPSECProfileID, and FQDN, create a ticket to the Versa Managed Services team.
GatewayProfileName	Name of the connecting gateway.
Priority	Gateway priority to use when connecting.
IPSECProfileID	Profile ID associated with the gateway.
FQDN	FQDN to reach the gateway.
Port	Port on which the gateway listens.
RouteConfig	Specify how to apply routes when establishing a tunnel: Split Tunnel—Specify how to handle split-tunnel traffic: False—Send all traffic over the tunnel. True—Send only traffic matching the routes in the configuration over the underlay network. Routes—Configure the routes for the client to route traffic: Prefix—Details of the route. The client routes destination traffic through the tunnel to this IP address. Metric—Metric value to use for the route.
TLSInfo (Group of Fields)	Values for the Transport Layer Security (TLS ) tunnel used for reliable, TCP-based encrypted communication.
MinimumVersion	Specify the minimum supported TLS protocol version accepted for the connection. For example, tls-1.2.
MaximumVersion	Specify the maximum supported TLS protocol accepted for the connection. For example, tls-1.2.
ProfileId	Specify the identifier that links this TLS configuration to a specific SSL/TLS profile defined on the gateway.
CipherSuites	Specify the cryptographic cipher suites for the TLS handshake. An empty array ([]) typically means the client defers to the gateway's default or system-defined cipher list.
Port	Specify the TCP port number used for the TLS connection. For example, 443.
DTLSInfo	Values for the Datagram Transport Layer Security (DTLS ) tunnel used for reliable, TCP-based encrypted communication.
MinimumVersion	Specify the minimum supported DTLS protocol version accepted for the connection. For example, dtls-1.2.
MaximumVersion	Specify the maximum supported DTLS protocol version accepted for the connection. For example, dtls-1.2.
ProfileId	Specify the identifier that links this DTLS configuration to a gateway SSL profile.
CipherSuites	Specify the cryptographic cipher suites for DTLS negotiation. An empty array defers to the gateway defaults.
Port	Specify the TCP port number used for the DTLS connection. For example, 443.
Tunnels	Specify the tunnel types the client supports and their negotiation priority. The numeric keys (0, 1, 2) represent preference order, with 0 being the highest priority. For example: "0": {"TunnelName": "dtls"}—DTLS is the first or preferred tunnel type. "1": {"TunnelName": "ipsec"}—IPsec is the second choice. "2": {"TunnelName": "tls"}—TLS is the fallback tunnel, used when DTLS and IPsec are unavailable or blocked.
HeartbeatInterval	Specify how frequently the VPN client sends a keepalive or heartbeat signal to the gateway to maintain the session and detect connectivity loss. For example, a value of 1 means the client sends a heartbeat every 1 second.
Domain Servers (Group of Fields)	DNS servers to use for name resolution.
DomainName	Name of the domain.
NameServers	IP addresses of the DNS server.

Create a Private App Protection Policy Rule for Pre-Logon Traffic

This example shows how to create an access policy rule to permit pre-logon tunnel traffic to reach the required services. This rule uses source IP subnet pools allocated for the pre-logon tunnel to limit resource usage.

To configure a private app protection policy rule:

In Tenant view, select Configure > Security Service Edge> Real-Time Protection > Private App Protection.
Click + Add. The workflow to create a private app protection rule displays.
Select step 5, Network Layer 3-4.
Click Customize in the Source & Destination (Layer 3) box.
In the Source & Destination (Layer 3) window, select the Source Address tab.
Add the source subnets allocated to the pre-logon client IP pools (for example, 10.10.11.0/24, 10.10.12.0/23, 10.10.13.0/24), and configure the required services.
Click Next or select step 6, Security Enforcement.
Select Allow.
For information about configuring other parameters, see Configure SASE Private Application Protection Rules.
Click Skip to Review or Next.
Enter a name for the rule, and then click Save.
When prompted to configure the rule order, select Process the rule first (add this rule at the top of the rule list). This ensures pre-logon traffic is matched before other rules.
Click Publish to push the configuration to all gateways.

Enable Pre-Logon on SASE Client

To enable the pre-logon option on the SASE client:

In Tenant view, select Configure > Secure Services Edge > Secure Access > Client-based Access > Policy Rules. The Client-Based Access Rules screen displays.
Click Client Download in the top right side. The following screen displays to download the client for various operating systems.
Click the OS (here, Windows) for which to download the SASE client and save the Here, we select Windows and the following screen displays to select the client version.
Download and install the application. For more information, see Configure the Versa SASE Client.
Start the application. The setup wizard screen displays.
In Select Components, select Pre-Logon.
Click Next. The Select Additional Tasks window displays.
Click Next. The Pre-Logon Configuration window displays.
Upload the pre-logon configuration file. For information about downloading the default pre-logon file that Versa provides, see Download the Default Pre-Logon File, above.
(Optional) Upload the CA certificate of the VSA server. In the CA Certification of VSA Server field, click Browse, and then select the certificate. You required the CA certificate only if you use your own CA for gateway certificate validation. You can skip this if you have already added it to the Trusted Root Authority. This
certificate validates the identity of the gateway as part of authentication process. You can also associate the pre-logon and CA certificate files after the client installation. For more information, see Configure Pre-Logon Settings, below.
Click Next. The Ready to Install screen displays.
Click Install. The installation begins, and an installation status screen displays. To stop the installation, click Cancel.
After the installation completes, the Completing the Versa Secure Access Client Setup Wizard screen displays.
By default, Launch Versa SASE Client is selected. Click to deselect the option.
Click Finish to complete the installation. The Register screen displays, unless you deselected Launch Versa Secure Access Client. For more information, see Register and Connect a Versa SASE Client.
Lock the device screen to display the network sign-in option on the locked screen. For more information, see Example of Pre-Logon using SASE Client, below.

Import a Device Certificate

Ensure that you import the device certificate to the Personal Store of the Local Machine certificate store, where the client checks for certificates issued by the certificate authorities uploaded as part of the CA chain in the portal.

To import a device certificate to a Windows device:

Double-click the certificate file, and then click Install Certificate. The Certificate Import Wizard displays.
Select Local Machine.
Click Next. The File to Import window displays.
Click Browse and upload the device certificate.
Click Next. The Certificate Store window displays.
Select Place all certificates in the following store, then click Browse and select Personal.
Click Next. The following window displays.
Click Finish.

Install Pre-Logon Using CLI

If you are using tools such as the Microsoft System Center Configuration Manager (SCCM), you can install and configure pre-logon on SASE clients from the CLI.

To silently install the SASE client with pre-logon enabled from the CLI, issue the following CLI command. For version-number, enter the version of client that you are installing.

VersaSecureAccessClient_version-number.exe /SP- /silent /components=base,prelogon /SUPPRESSMSGBOXES /LOG="log-file-path" /NOICONS /ALLUSERS

Configure Pre-Logon Settings

This section describes how to configure the pre-logon configuration file. You can also perform this step if you do not upload a pre-logon configuration file during the SASE client installation.

Select the folder in which the SASE client application is installed, for example, C:\Program Files (x86)\Versa Secure Access>.
In the file explorer path of this location, type cmd and then press Enter. The following command prompt displays.

To apply the pre-logon configuration, issue the following CLI commands. Note that you must run these commands from administrator mode.

C:\Program Files (x86)\Versa Secure Access>VersaSecureAccessClientConsole.exe --prelogon_config
C:\Users\user\Desktop\PrelogonConfig\PreLogonConfig.json --trusted_root_ca_certificate
C:\Users\user\Desktop\PrelogonConfig\VersaIntermediateCertificateAuthority1.cer --silent
453 [1] INFO Versa Secure Access (null) - Starting application in prelogon_config mode. Version 7.2.11_51ee8fb6
515 [1] DEBUG Versa Secure Access (null) - Prelogon configuration initiated
515 [1] DEBUG Versa Secure Access (null) - Verifying and Applying Prelogon Configuration
2062 DEBUG Versa Secure Access (null) - Prelogon Configuration Applied Successfully!

Reboot the device to display the network sign-in option on the locked screen. For more information, see Example of Pre-Logon using SASE Client, below.

Edit the Pre-Logon Configuration File Controls

You can edit the pre-logon configuration file to change the control settings.

Select the pre-logon configuration file (here, PreLogonConfig.json) and right-click to edit the file using. Here, Notepad ++ is used.
To edit the pre-logon control options, edit the fields displayed under PrelogonControl at the top of the file.
1. To disconnect pre-logon when a user registers on the VSA portal and connects after login, change the PrelogonDisconnectOnConnect value to "true." The default is "false."
2. To disconnect the pre-logon connection after a number of minutes, update the AutoPrelogonDisconnectTimeoutMins value. The default is 60 minutes, and the range is 5 through 120 minutes.
Save the file.
Follow the steps described in Configure Pre-Logon Settings, above, to update the pre-logon configuration file on the endpoint machine.

Example of Pre-Logon using SASE Client

After you configure pre-logon on the SASE client application, new users who do not have connectivity to your network's AD can log in to the network. The example screens in this section show how a new user can log in to the network.

After you configure pre-logon on an endpoint machine, when a new user logs in, the network sign-in option displays on the locked screen.
When the user clicks the Network sign-in, the following screen displays.
To login, the user clicks Logon Using Versa Secure Access. The SASE client login screen displays.
When the user clicks the Connect icon, the option to enter login credentials displays.
The user then enters the user ID and password provided by the network administrator, and clicks Submit to log in to the network.

(For Windows) To verify the connection, after you log in, open the command prompt and run the route print CLI command. The following example shows that the tunnel is established with the SASE gateway and the default route points to the gateway tunnel IP address formed during pre-logon:

IPv4 Route Table
================================================================================
Active Routes:
Network Destination        Netmask          Gateway        Interface       Metric
          0.0.0.0          0.0.0.0          10.163.0.1     10.163.104.25   281
          0.0.0.0          0.0.0.0          On-link        10.200.1.57     3
          8.8.8.8          255.255.255.255  On-link        10.200.1.57     10
     10.163.0.0            255.255.0.0      On-link        10.163.104.25   281
     10.163.104.15         255.255.255.255  On-link        10.163.104.25   26
     10.163.104.25         255.255.255.255  On-link        10.163.104.25   281
     10.163.255.255        255.255.255.255  On-link        10.163.104.25   281
     10.192.181.20         255.255.255.255  10.163.0.1     10.163.104.25   525
     10.200.1.57           255.255.255.255  On-link        10.200.1.57     258
        127.0.0.0          255.0.0.0        On-link        127.0.0.1       331
        127.0.0.1          255.255.255.255  On-link        127.0.0.1       331
  127.255.255.255          255.255.255.255  On-link        127.0.0.1       331
        224.0.0.0          240.0.0.0        On-link        127.0.0.1       331
        224.0.0.0          240.0.0.0        On-link        10.163.104.25   281
        224.0.0.0          240.0.0.0        On-link        10.200.1.57     258
  255.255.255.255          255.255.255.255  On-link        127.0.0.1       331
  255.255.255.255          255.255.255.255  On-link        10.163.104.25   281
  255.255.255.255          255.255.255.255  On-link        10.200.1.57     258
================================================================================

Supported Software Information

Releases 12.1.1 and later support all content described in this article.
Releases 7.8.9 of Versa SASE Client and later support all content described in this article.

Additional Information

Configure SASE Tenants