https://worldofeuc.com logo
Join Slack
Powered by
Anyone ever set up microvpn with intune? I’m tryin...
# citrix-netscaler
m
Anyone ever set up microvpn with intune? I’m trying to do it for a client and running into issues but I think they might be on the intune side
👀 1
m
Microvpn how? Using Netscaler vpn vserver as Endpoint and CitrixSSO as VPN Client. I have done this with android phones and iOS. It is a little bit buggy but for most applications it works fine.
where are you stuck?
m
launching edge on an intune device doesn’t send seem to send an oauth token to the nestsclaer
m
okay, I always used client certificate for the authenticaiton. cause I did not get througth the oauth, at least not interactionless for the user
m
The default config uses an oauth loginschema, it seems to be talking to the intune backend fine as the oauth status shows complete, so I’m guessing something is missing on the intune config side but I have no visibility into that 😞
p
Frfr literally struggling with this today!
Mike if you solve this please ping me over and over til i respond 😅. Im apparently having cert issue as on secure sso client i see invalid client cert. But ca certs bound and crls and such all good.
Happy to collaborate on this
m
I have no idea what I’m doing lol, don’t think I’ll be a lot of help. All I know if you need to have the root and intermediate certs on the netscaler and in Entra
m
I would start with an easier configuration. Just citrix sso and the client certificate and if that works go on with the device compliance.
p
Yea we bound all that up. Disappointing since we've done cert auth a heap and even had the per-app vpn demo working with Citrix endpoint management, but doing the Intune side, now having issue after issue sigh
Going to try to validate that piece using windows pc to see if i at least get login schema to load today
As it turns out, had a rogue responder policy dropping traffic. Working through this now... got connected to vpn at least using this guide https://docs.netscaler.com/en-us/netscaler-gateway/current-release/microsoft-intune-in[…]ual-server-for-single-factor-authentication-deployment.html
m
do you have to use NAC though?
p
I suppose not, but thats something we want to do in our case. Are you looking to deploy the per app VPN only?
m
They just want to replace the xenmobile vpn
so this is really just to get access to internal exchange servers (I know, use O365, they are, this whole project is insane)
p
At a basic level, a GWVS with cert auth is all you'd need - this will be similar to the XM setup for auth in many cases where you want 'seamless' per app vpn. Configure intune to issue the user certs, extract username from cert to do any group checks you need, if any, on adc from san. Then use https://learn.microsoft.com/en-us/mem/intune/configuration/vpn-settings-ios to configure hte microsoft side
m
for some reason they won’t migrate to O365 until they can get people off of xenserver and onto this microvpn intune thing
p
On the VPN-setting side theres only like 4-5 boxes to fill in. I suppose the question is why would you not want NAC if its available?
m
yeah I don’t think they are doing any of that, the intune guy keeps saying there’s no certsd, and nothing is set up for a cert authority in azure
p
if you're wanting to allow a vpn wouldnt you only want to allow devices that are enrolled and compliant?
m
you would think…
they were talking about doing it with username and pass so…
p
its not a great user experience but you could just setup a gateway with LDAP/RADIUS or whatever (per standard), configure hte VPN 'settings' as above and call it a day. experience when launching the app would say SIGN IN REQUIRED TO CONTINUE, fill in user/pw any mfa prompts and away you go
m
right now it’s just set up using the default script and filling in the parts it said to fill in, which just sets it up for oauth I thought?
p
The "Intune integration" script does what the article above says - the NAC stuff. If you dont want any of that, you will need to roll your own
m
oh well that’s where it’s failing then because they don’t have any cert stuff set up
p
start with a basic GWVS for basic functionality of vpn
m
I’m tempted to do this with SAML and entra and call it a day
p
Yeah the guide assumes you want to have a more seamless experience - so its assuming you're going to do cert auth as stage 1 and a NAC check as stage 2
m
right, I thought it was trying to do a upn extract from a cert but kept getting told they aren’t doing certs
ok, so the issue they are having is that the request goes all the way to intune and gets rejected as an unmanaged vpn, even though it’s coming from a managed device. The request doesn’t have a user id in it though, and I’m guessing it should?
p
Hm, I'm not sure on that one- as part of our process we're deploying the VPN profile as a managed connection from a managed device. In our setup, the username is irrelevant as the connection to gateway is only allowed with a valid, nonrevoked user cert, which as part of the connection process, sends the deviceid to also valid NAC for good measure. (This is now fully tested as of this morning and working so I can share any learnings there if you do go down that route).
m
We may have to do that just to get it working
there’s no NAC set up as of yet
Open in Slack
PreviousNext
Powered by