Using Global VPN Client from a Different Workstation

Using the SonicWall Global VPN Client to connect to a Microsoft Network has certain limitations. Typically, when a computer is attached to a Microsoft Network it has a persistent network connection to the domain controller that is used to verify the user credentials. When the user credentials have been verified by the domain controller, the computer then creates a locally cached profile that is used when the domain controller is not available. However, the SonicWall Global VPN Client provides an ad hoc secure network connection over the Internet back to the Microsoft Network containing the domain controller and thus is not a persistent connection. Since the remote computer cannot connect to the domain controller to verify the logon credentials until the connection is provided by the SonicWall Global VPN Client, the logon fails unless a locally cached profile is available.

The following steps illustrate the classic problem:

1. A Global VPN Client session must be established to communicate remotely with a Microsoft domain controller.

2. Global VPN Client can only be launched after you have logged on to the workstation. Because there is no way for the Global VPN Client to connect before you log on, you cannot use it for domain logon when initially logging on.

3. If you have logged on to the workstation before, there will be a locally cached profile that is used to log on.

   1. You can then start the Global VPN Client, and a connection to the domain is established.

   2. After connecting to the domain, you can run logon scripts, change password, access domain resources, etc.

   3. When you log off, the Global VPN Client terminates, preventing domain communications.

4. If you have never logged on to the workstation before, there will not be a locally cached profile, so logon will not be possible.

Because logging off (as mentioned in Step C) terminates the SonicWall Global VPN Client, it has historically precluded a different user from logging on and creating a new locally cached profile. This has the undesirable effect that only a user with a pre‐existing (locally cached) profile can log on over the Global VPN Client.

The standard workaround for this is to first connect locally to the domain controller and logon with each account expected to use the SonicWall Global VPN Client. This creates a locally cached profile for each account and enables client logon without connection to the Domain Controller.

The unfortunate result of this workaround is that a user without a cached profile on the computer cannot logon without a sojourn to the network containing the domain controller. This can be extremely cumbersome in certain situations such as being located in a distant satellite office and trying to get back to the main office.