Always On

When to Use Always On

• An employee starts the laptop outside the enterprise network and needs assistance to establish VPN connectivity.Solution:  When the laptop is started outside the enterprise network, Always On seamlessly establishes a tunnel and provides VPN connectivity.
• An employee using VPN connectivity moves into the enterprise network. The employee is switched to an enterprise network but remains connected to the VPN tunnel, which is not a desirable state.Solution:  When the employee moves into the enterprise network, Always On tears down the VPN tunnel and seamlessly switches the employee to the enterprise network.
• An employee moves outside the enterprise network and closes the laptop (not shut down). The employee needs assistance to establish VPN connectivity upon resuming work on the laptop.Solution:  When the employee moves outside the enterprise network, Always On seamlessly establishes a tunnel and provides VPN connectivity.
• An enterprise wants to regulate the network access provided to its users when they are not connected to a VPN tunnel.Solution: Depending on the configuration, Always On restricts access, allowing users to access only the gateway network.

Understanding the Always On Framework

Considerations While Enabling the Always On feature

Configuring Always On

1. In the NetScaler GUI, navigate to Configuration > NetScaler Gateway > Policies > AlwaysON.
2. On the AlwaysON Profiles page, click Add.
3. On the Create AlwaysON Profile page, enter the following details:
   • Name – The name for your profile.
   • **Location Based VPN (client-side registry name: LocationDetection) – Select one of the following settings:
     • Remote to enable a client to detect whether it is in the enterprise network and establish the tunnel if not in the enterprise network. Remote is the default setting.
     • Everywhere to let a client skip the location detection and establish the tunnelregardless of the client's location
   • Client Control – Select one of the following settings:
     • Deny to prevent the user from logging off and connecting to another gateway. Deny is the default setting.
     • Allow to enable the user to log off and connect to another gateway.
   • Network Access On VPN Failure (client-side registry name: AlwaysOn) – Select one of the following settings:
     • Full Access to allow network traffic to flow to and from the client when the tunnel is not established. Full Access is the default setting.
     • Only To Gateway to prevent network traffic from flowing to or from the client when the tunnel is not established. However, the traffic to or from the Gateway IP address is allowed.
       Note: In Only To Gateway mode, only the virtual server, DNS, and DHCP traffic are unblocked. To unblock other websites, IP address ranges, or IP addresses, you must set the AlwaysOnAllowlist registry with a semicolon-separated list of FQDNs, IP address ranges, or IP addresses. For example, mycompany.com,mycdn.com,10.120.67.0-10.120.67.255,67.67.67.67
4. Click Create to finish creating your profile.

1. In the NetScaler interface, select Configuration > NetScaler Gateway > Global Settings.
2. On the Global Settings page, click the Change Global Settings link, and then select the Client Experience tab.
3. From the AlwaysON Profile Name drop-down menu, select the newly created profile, and click OK.

Note on IIPs

Allowing selected URLs when Always On is down