To use F5 Access for network access on Microsoft Windows 10, you must configure a VPN profile and specify F5 VPN as the VPN provider.

The new VPN profile appears on the list.

Connect to a profile to use the connections to your network supported by F5 Access.

The VPN profile displays as "Connected."

You can terminate an existing F5 Access VPN connection.

The VPN connection terminates.

Creating a client certificate for second-factor authentication

This example shows how to create a VPN profile that uses a certificate issued by Site Request, Inc. for second-factor authentication. The certificate must already be installed on the client device. F5 Access can read the certificate from certificate storage on the device or from a smart card inserted into the device.

$xml = "<f5-vpn-conf><client-certificate><issuer>Site Request Inc</issuer></client-certificate></f5-vpn-conf>"
$sourceXml=New-Object System.Xml.XmlDocument
$sourceXml.LoadXml($xml)

Add-VpnConnection -Name F5_vpn_cert -ServerAddress apm_server_fqdn -SplitTunneling $True -PluginApplicationID F5Networks.vpn.client_btcnfmkykcjs2 -CustomConfiguration $sourceXml

Using a nonstandard port

This example shows how to create a VPN profile using port 444 to connect to the BIG-IP system.

$xml = "<f5-vpn-conf><port>444</port></f5-vpn-conf>"
$sourceXml=New-Object System.Xml.XmlDocument
$sourceXml.LoadXml($xml)

Add-VpnConnection -Name F5_vpn_port_444 
-ServerAddress apm_server_fqdn
-SplitTunneling $True
-PluginApplicationID F5Networks.vpn.client_btcnfmkykcjs2
-CustomConfiguration $sourceXml

Using the landing URI

This example shows how to create a VPN profile using the landing URI to connect to the BIG-IP system.

$xml = "<f5-vpn-conf><landing-uri>test</landing-uri></f5-vpn-conf>"
$sourceXml=New-Object System.Xml.XmlDocument
$sourceXml.LoadXml($xml)

Add-VpnConnection -Name F5_vpn_landing_uri -ServerAddress apm_server_fqdn -SplitTunneling $True -PluginApplicationID  F5Networks.vpn.client_btcnfmkykcjs2 -CustomConfiguration $sourceXml

Configuring multiple servers for VPN connection

This example shows how you can configure multiple servers for VPN connection. F5 Access attempts to reach each server in the list until it successfully authenticates the user.

$VPNConnectionName = "Global VPN"
$PluginApplicationID = "F5Networks.vpn.client_btcnfmkykcjs2"

$VPNServerList = @()
$VPNServerList += New-VpnServerAddress my1.server.fqdn -FriendlyName Africa
$VPNServerList += New-VpnServerAddress my2.server.fqdn -FriendlyName Europe
$VPNServerList += New-VpnServerAddress my3.server.fqdn -FriendlyName Asia
$VPNServerList += New-VpnServerAddress my4.server.fqdn -FriendlyName "North America"
$VPNServerList += New-VpnServerAddress my5.server.fqdn -FriendlyName  "South America"
$VPNServerList += New-VpnServerAddress my6.server.fqdn -FriendlyName  Antarctica
$VPNServerList += New-VpnServerAddress my7.server.fqdn -FriendlyName  Australia

$xml = "<f5-vpn-conf><log-level>debug</log-level></f5-vpn-conf>"

# Validate XML configuration
$ErrorActionPreference = "Stop"
$sourceXml=New-Object System.Xml.XmlDocument
$sourceXml.LoadXml ($xml)

# Remove existing entry
$VPNConnections = Get-VpnConnection
foreach ($i in $VPNConnections) {
    if ($i.Name -eq $VPNConnectionName) {
        Write-Host "Remove VPN connection:" $VPNConnectionName
        Remove-VpnConnection -Name $VPNConnectionName
    }            
}

# Add new entry
Write-Host> "Configure VPN connection:" $VPNConnectionName "with default server:" $VPNServerList [0].ServerAddress "VPNP ID:" $PluginApplicationID
Add-VpnConnection -Name $VPNConnectionName -ServerAddress $VPNServerList[0].ServerAddress -SplitTunneling $True -PluginApplicationID $PluginApplicationID -CustomConfiguration $sourceXml -ServerList $VPNServerList

Useful PowerShell commands

Powershell command syntax

Use the Get-Help command in Powershell to view command syntax. For example, type Get-Help Add-VpnConnection.

Triggering a connection (SR_SanJose) with the application notepad.exe

Add-VpnConnectionTriggerApplication -ConnectionName SR_SanJose -ApplicationID "C:\Windows\System32\notepad.exe"

<?xml version="1.0" encoding="utf-8"?>
<xs:schema id="XMLSchema"
    targetNamespace="http://siterequest.com/XMLSchema.xsd"
    elementFormDefault="qualified"
    xmlns="http://tempuri.orgsiterequest.com/XMLSchema.xsd"
    xmlns:xs="http://www.w3.org/2001/XMLSchema">
  <xs:simpleType name="log-levelType">
    <xs:restriction base="xs:string">
      <xs:enumeration value="default"/>
      <xs:enumeration value="minimum"/>
      <xs:enumeration value="info"/>
      <xs:enumeration value="debug"/>
    </xs:restriction>
  </xs:simpleType>
  <xs:element name="f5-vpn-conf">
    <xs:complexType>
      <xs:all minOccurs="0">
        <xs:element name="port" type="xs:unsignedShort" default="443"/>
        <xs:element name="landing-uri" type="xs:anyURI"/>
        <xs:element name="ssl-encryption" type="xs:boolean" default="true"/>
        <xs:element name="tls1.2" type="xs:boolean" default="true"/>
        <xs:element name="authenticate-retries" type="xs:unsignedByte" default="3"/>
        <xs:element name="log-level" type="log-levelType" default="default"/>
        <xs:element name="optimize-for-low-cost-network" type="xs:boolean" default="false"/>
        <xs:element name="single-sign-on-credential" type="xs:boolean" default="true"/>
        <xs:element name="client-certificate">
          <xs:complexType>
            <xs:all minOccurs="0" maxOccurs="1">
              <xs:element name="issuer" type="xs:string" minOccurs="1"/>
            </xs:all>
          </xs:complexType>          
        </xs:element>
      </xs:all>
    </xs:complexType>
  </xs:element>
</xs:schema>

You can deploy a VPN connection on F5 Access for F5 Access using Airwatch 8.0.

You have now deployed an F5 VPN connection profile.

Client certificate configuration requirements

In the access policy, you can use the Client Cert access policy item or the On-Demand Cert Auth access policy item.

In the client SSL profile for the virtual server, select request for the Client Certificate property.

F5 Access for Windows 10 access policy example

To configure F5 Access for Windows 10 to be detected, use the F5 Access branch of the Client Type access policy item. F5 Access is detected as "F5 Access" on this branch. The Client Type for F5 Access differs from F5 Inbox VPN Client for Windows 8.1 (detected as "Windows Inbox F5 VPN Client") and BIG-IP Edge Client for Windows Phone 8.1 (detected as "Edge Client").

To detect F5 Access for Windows 10 with the Client OS access policy item, you must modify the Client OS branch rule for Windows as follows.

Click the Client OS item, click the Branch Rules tab, and click change at the bottom of the Windows branch rule.

Click the Advanced tab, and add the following to the Windows expression.

|| [mcget {session.client.platform}] == "Windows"}

Click Finished, then Save, and change the ending to Allow on the Windows branch. The access policy appears as follows.

Typically, in a network access configuration after authentication, you assign resources to the client. Resource assignment access policy items are omitted from this example for the sake of readability.