2 Different remote VPN connect methods on a single portal&single gateway

L4 Transporter

2 Different remote VPN connect methods on a single portal&single gateway

I have external contractors connecting to my GP Portal in an on-demand connection setup.

Is it possible to enable 'always-on' VPN on same portal and gateway pair alongside with on-demand?



L7 Applicator

Yes it is, i have several options on the same portal, some are on demand, some are always on and others include manual gateway selections and the option to disable GP. Just do it by users or users group.


at the very bottom of my list i have a default one.... this may be best to use for anybody who connects but put your configs for users and groups above the default as they will use the first that applies.


post again if you require any further infi...

L4 Transporter

@MickBallThank you so much for your response.

I have a RADIUS authentication method setup for contractors today for on-demand. I can't think of having my internal users using always-on without having to go through RADIUS authentication at the same time my contractors using RADIUS.

can you please provide me any ideas how to accomplish this?



L7 Applicator

Sorry @SThatipelly, i dont understand what you are asking, 

I understand that your contractors are on demand with radius but not sure what you need for internal users.

L7 Applicator

What authentication method do your internal users have.

L4 Transporter

I am trying to configure always-on with LDAP authentication for my internal users, meaning my users should connect to the network with their AD creds as soon as they go outside. At the same time, my contractors should use RADIUS for on-demand.

L7 Applicator

Yes you can do this but i have never tried it.


you need to set up an authentication sequence.


if you have more internal users than contractors put ldap first, if more contractors than internal users then radius first.


then place this in the authentication section of the portal.


then on the agent section...   add a config called contractors, add each of the contractors login id. Set the app here to on demand

then add a config called default. Leave the users blank, set this app to always on, plus any other options needed.


for both , set authentication overide, also allow this on the gateway. Then they can both share the same gateway also.


do as much as you can, if you get stuck i will go into greater detail but get the authentication sequence working first.

L4 Transporter

@MickBallSure. But, before doing it, I justhave  couple of final questions(As it is on production firewall, I'm trying to gather as much info as I can). My cuurent setup has RADIUS for gateway authentication. As I am doing the auth override on portal, should I be least worried about this tab on gateway?

Am I correct in assuming that keeping the current config on GAteway as is but adding new "client settings" config(Diff pool for internal users) will work?


thank you so much.

L7 Applicator

Im not sure what you are asking, if it helps... you can have auth overide and radius on gateway. If the user does not have auth overide cookie then it will fall back to radius.


if you cannot afford to mess up your config, why not set up a loopback address and test on that.

L7 Applicator

Also... you dont have to use auth overide.


if you have auth sequence in portal then just have the same auth sequence in gateway.


i just prefer overide... especially for OTP.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!