This article explains how to configure the Pre Login settings to provide initial authentication to securely access networks and resources.
Pre Login is an essential component of Zero Trust Network Architecture (ZTNA). It provides access to devices based on their Device Authentication and before the user is authenticated. The granular Pre Login policy defines a limited access policy of Allowed Destinations that are applied to trusted devices.
Cato's Pre Login feature addresses the problem of the initial authentication for a device, a common example is that a new device is sent to a new remote user. The device needs to connect to the company’s Active Directory (AD) to complete the user authentication. However, since this is a new device, there are no users Windows users credentials on it, and unauthenticated users aren’t allowed to connect to the AD.
Cato’s solution is based on pre-deploying a trusted certificate and the Cato Client on the device. This establishes enough trust to let the device connect to the Pre Login resources that you configure. Then the user can securely authenticate to the device.
As soon as the device can connect to the public Internet (such as, WiFi in the user’s house), or if a Windows users signs out, the Cato Pre Login feature lets the device connect to the Pre Login resources.
The Windows device is pre-configured with the Cato Client, a trusted certificate, and the Windows registry is configured with the account name. The Client then connects to the relevant resources, for example, connect to the AD and the user then authenticates the device. Once the Windows device successfully authenticates to the Cato Cloud, Windows user credentials are saved to the device, and in the future it can authenticate and connect to the AD as required.
Windows devices that meet all of these prerequisites can use Cato's Pre Login feature.
-
Cato SDP Client requirements:
-
Supported from Window Client v5.4 and higher
-
Client is installed on the device
-
-
Certificate requirements:
-
Upload signing certificate to the Cato Management Application (Access > Client Access > Device Authentication)
For more information about uploading certificates, see these articles.
-
Install a signed device certificate on the Windows device
-
-
Configure the Windows registry for the Client on the device Computer\HKEY_LOCAL_MACHINE\SOFTWARE\CatoNetworksVPN:
-
Enable Pre Login for this device
PreLogin (DWORD), value data 1
-
Configure the account name as it appears in the Cato Management Application
Subdomain (String), value data <account subdomain>
For example, the account name SampleCo has the subdomain: sampleco.via.catonetworks.com
You can show the subdomain for your account in Access > Single Sign-On
-
After the Client successfully performs the initial authentication to the Cato Cloud, the registry is automatically updated
-
-
For accounts that use a private DNS server (including internal AD servers), configure these settings:
-
The private DNS server is defined as an Allowed Destination
DNS servers defined for the account are automatically included as an Allowed Destination
-
DNS Forwarding is enabled, and configured for the private DNS server
-
By default, the Cato Client sets the DNS server as 10.254.254.1
If your account uses a custom service range, the IP address for DNS is x.y.z.3
-
-
SDP Clients that are configured with Always-On, are only allowed to connect to:
-
WAN - Resources defined in Allowed Destinations
-
Internet - Authenticate the user with the IdP
-
-
SDP Clients without the Always-On settings (including new devices), are allowed to connect to:
-
WAN - Resources defined in Allowed Destinations
-
Internet - Windows device can connect to any resource in the Internet
-
-
For security reasons, we recommend that you define the smallest IP range for an Allowed Destination
If Pre Login and Connect on Boot are both enabled, after the device boots the Client enters Pre Login state. Once a user signs into the device the Client attempts to authenticate the user. For more information, see Understanding the Cato Client Connection Flow.
-
Challenge - A brand new Windows device is sent to an employee at their house. The corporate AD is behind a Cato site, so the new user can't connect to it.
-
Solution - The device meets the Pre login prerequisites above. The user turns on the computer, it is allowed to connect to the AD, and the user authenticates to the AD and is allowed to connect to the network.
-
Use the Pre login screen to define the resources in the Allowed Destinations that the pre-configured Windows devices can connect to. When the Client on the device attempts to connect to the Cato Cloud, the device is recognized as a Pre login device.
The Cato Cloud allows the device to connect to the resources that are configured as an Allowed Destination, and the WAN and Internal firewall rules are not applied to this connection. In addition, the Device Posture requirements are not applied to the Pre Login traffic. The Cato Cloud only allows traffic that is related to the Pre Login process.
An Allowed Destination can be a IP address, IP range, or a host (which is defined for a specific site). Pre Login supports up to 48 Allowed Destinations.
To configure your account to support Pre Login:
-
From the navigation menu, click Access > Client Access.
-
Expand the Pre Login section.
-
Select Enable Pre Login.
-
From the drop down menu, select the Host, IP address, or IP range for each Allowed Destination.
Note: For security reasons, do not use the IP range 0.0.0.0 - 255.255.255.255 as an Allowed Destination.
-
Click Save.
6 comments
Added Requirements for Allowed Destinations with clearer details for on-prem AD servers
Why isn't using 0.0.0.0 - 255.255.255.255 as an Allowed Destination recommended? Will that grant anonymous access to all private IP ranges for the Cato account? How about just listing the public IP address ranges of the Internet?
Is there a way to allow access to specific websites via FQDN in Pre Login Allowed Destinations?
Hi Joseph Haney,
This is not currently supported. An Allowed Destination can only be a IP address, IP range, or a host (which is defined for a specific site).
We have scripts setting our registry key subdomain to sampleco.via.catonetworks.com (using our actual subdomain rather than sampleco), but it seems that the Cato client then changes it to sampleco. Is this expected behavior?
Hi William Brickles,
Yes this is expected behavior
Please sign in to leave a comment.