Client-to-Site Group Policy Settings

Select the credentials required for client authentication:

• X.509 Certificate – Client certificate authentication mandatory. 
• External Authentication – User password authentication mandatory. 
• IPsec needs Xauth – Select to allow only IPsec clients that support Xauth.

Select Login must match AltName in Certificate if certificate lookup is done by Alternative Name.

The default or fallback authentication scheme used to authenticate VPN clients.

Select the Ras Login permission required check box if Remote Access login is required. As soon as Ras Login permission required is activated, only an MSAD user with this option can connect. Users in other authentication databases, for example, LDAP, do not have this option as default and will not be able to connect. As a workaround, the user can be assigned a Boolean attribute with the name msNPAllowDialin in the directory. The VPN server itself does not distinguish between directories when querying.

Extract the username from the selected client certificate field. The X.509 Login Extraction Field is only used for pre-authentication.

Set the VPN client IP address to the attribute configured in the LDAP, MSAD, or RADIUS server.

Name of the attribute field on the authentication server that contains group information.  The VPN group policy is pinned to the value returned by the LDAP, MSAD, or RADIUS server.

Attributes from LDAP, MSAD, or TACACS+ authentication schemes are used to determine the default authentication scheme for the user. As soon as only a username is used, the configured default authentication scheme will be used. The username must also exist in LDAP (or the corresponding authentication scheme) or the option Alternative Login Name Field must be used.

• Authentication Selector Field – Enter the attribute name (e.g., memberOf for group membership information, distinguishedName for object path) whose attribute value is used to select the authentication scheme. Example: ngflocal, msad, etc.
  Right-click and select New name to Scheme Mapping to create mappings between attribute values and authentication schemes that should be used in case of a pattern match.
  Example: If all users located within the Organizational Unit (OU) RADIUSUsers should be authenticated with RADIUS, you can create a mapping for the distinguishedName attribute like this:
  
• (optional) Alternative Login Name Field – Enter the attribute name where an alternative username can be stored if an additional username should be used for a user with the same password.

• IP Address Field – IP attribute name without pre-authentication: Enter the attribute name where the IP address for the VPN client is stored.

  The field must exist in LDAP/MSAD and return the desired IP address as value. A combination consisting of fixed and dynamic IP addresses in the same VPN Client is not recommended. In this case, consider using two VPN Client networks instead. To avoid IP collisions, you could also generate Barracuda VPN Lic File entries. This would exclude IP addresses from being assigned dynamically.

• VPN Group Field – Enter the attribute name where the VPN group policy name is stored. The VPN group policy name attribute lets you assign a VPN group policy directly to the client, without a pre-authentication scheme. Example: If the LDAP field NGVPNGROUPPOLICY for a user contains iOS, the user gets the corresponding group policy assigned.
• Group Information – Select the source of the user group information.
  • From Preauthentication – Use group information from the pre-authentication scheme.
  • From Authentication – Use group information from the default authentication scheme.

Enter a name for the policy. For example, Group Policy.

• The Common Settings field is automatically updated with this name, and the check box is automatically selected as soon as you fill in the details.
• This name is also used on native VPN clients on iOS and Android

Select the VPN client network the group policy applies to.

Add all networks that should be reachable by the VPN clients. Enter 0.0.0.0/0 for all traffic to be sent through the client-to-site VPN. 

Define the groups on the authentication server that will be assigned the policy. E.g., CN=vpnusers* or * for everybody


To let everyone with a valid certificate log on, click Edit/Show and add the following condition to the Subject field: CN=*. Certificate condition entries are case insensitive and can contain the quantification patterns ? (zero or one) and * (zero or more).

(Optional) Enter an OID to allow only certificates with a specific key usage. E.g., Client Authentication (1.3.6.1.5.5.7.3.2)

Click Edit/Show to open the Certificate Condition window. Configuration may contain patterns (*,?). Equal keys are slash delimited: To match for DC=foo, DC=bar, you have to enter DC=bar/foo. The order of the distinguished name parts is reversed.

Enter an OID to allow only certificates with a specific key usage. E.g., Client Authentication (1.3.6.1.5.5.7.3.2).

You can enter an OID of an arbitrary X.509 v3 extension that will then be searched in the extensions of the transmitted certificate and checked against the value configured in the Content field.

V_ASN1_IA5STRING and V_ASN1_OCTET_STRING entries can be entered as value, entries of another type will be configured as hexadecimal DER-encoded chain: e.g., for presence of the attribute clientAuth in the Extended Key Usage extension, the OID 2.5.29.37 with the value 300A06082B06010505070302 must be searched.

Select the check boxes for the client types used by the peer.

• Barracuda Client – Barracuda VPN Client or Barracuda Network Access Client including CudaLaunch for Android and iOS.
• IPsec Client – IPsec clients such as the native Windows, Android, or iOS IPsec VPN clients.
• Transparent Agent (SSL-VPN) – The legacy SSL VPN transparent VPN client.

Click Add to add the IP address of the peer network.

Enter a name for the Barracuda Client connection.

Enables the Barracuda Network Access Client. For more information, see Barracuda Network Access and VPN Client. 

Possible values are:

• OFF: This is the default setting.
• ON: An active ENA option blocks all traffic on non-VPN interfaces, e.g., LAN. This option is normally used in conjunction with the default route 0.0.0.0/0, so that all traffic is routed through VPN.

Assigns an online ruleset configured in the VPN FW tab.

Welcome messages can be used to display customized messages to welcome users to the corporate network, inform them about security policies, or display administrator contact details. Create a custom welcome message in the Message tab of the Client to Site page, and then select the message in this section.

Upload a 150x80 pixel, 256 color BMP bitmap in the Pictures tab of the Client-to-Site page, and then select the custom bitmap in this section.

The ciphers that can be used to establish the connection.

Enforce Windows security features:

• Network Firewall – A personal firewall must be enabled.
• Windows Update – MS Windows Automatic Update must be enabled.
• User Account Control – User Account Control must be enabled.
• Virus Protection – An antivirus product must be enabled.
• Spyware Protection – An anti-spyware product must be enabled.
• Internet Security Settings – Internet Security Settings must be enabled.