This feature is not supported on firewalls. You can configure this feature only on an SMA appliance.
Always-on VPN (AOV) supports SMA in conjunction with the Windows NetExtender client. AOV provides continuous network access to remote users. A user logon event triggers AOV detection and ends when the user logs out of the computer. AOV settings apply to Domain, Group, and User and have an inherited relationship. In AOV mode, the VPN CLI tool cannot disconnect the VPN or edit profiles.
For more information on enabling Network Logon (PreLogon) and other information, see the section Enabling Always-On VPN Connection.