Forum Discussion

Mike_Finney_119's avatar
Mike_Finney_119
Icon for Nimbostratus rankNimbostratus
Dec 04, 2013
Solved

Is it possible to connect to VPN from a Windows client command line without user interaction?

I am trying to get our F5 11.4 APM set up to work with remote Windows clients that need to connect and then disconnect from the VPN without any user interaction. To briefly summarize, this is for a remote password self-service application, so I need for the client machines to be able to do a remote command line access using "f5fpc -start /c "C:\Program Files\F5 VPN\client.f5c /t /q" so the users don't get any prompts or pop-ups, the client.f5c file has to provide the username and password and server to connect to, then the password self service app does its thing, and finally issues the command "f5fpc -stop" at the end to close the VPN session out. This needs to be done in the background as it is using straight username and password authentication and we don't want the users to see that.

 

I keep getting authentication failures, and when I check the client.f5c, I see that it has not saved my password. I went back and checked my F5 settings, and sure enough the save password on exit setting is set to false. Even if I edit the file and save it, it just ignores the password I put in there and removes it afterwards. I guess I would need to set the connectivity profile to allow password caching and save it to disk, but can I make that change, download the package with those options, and then change it back as we generally don't want the passwords to be cached?

 

How would I need to configure the access policy for this to work? I tried with and without a logon page, but I don't seem to be getting a username and/or password passed through from the client, none of the session variables show the values from the edge client config file. Is there a way to do this without a logon page so it is completely transparent and silent to the users?

 

APM
design
microsoft
security
  • DannyG_34437's avatar
    DannyG_34437
    Sep 25, 2014

    Older post, but I've done something similar.. I was able to use the following command on a windows machine to accomplish what I needed:

     

    taskkill /F /IM f5fpclientW.exe

     

    Thanks, dg

     

8 Replies

Sort By
  • Mike_Finney_119's avatar
    Mike_Finney_119
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2013
    This is a tough one, I am now able to get the logon to work by invoking it from the command line but as it apparently won't save the password or use a pre-populated one, I can only make it work using a logon page and entering the password there. It does save the username, but not the password. I changed my policy to allow password saves to disk, generated a new BigIPClientSetup.exe file and uninstalled/reinstalled on my test machine, but it still won't save the password and it blanks the password I typed into the file. Is there no way to do this? Also, the f5fpc.exe -stop command won't do anything without the session number or a favorite ID. Is there any other way to terminate the VPN connection easily from the client end via command line? I see the session number when using the f5fpc -info command, but user intervention cannot be used here and parsing out the number appears to be a non-trivial task. Thanks!!!
  • Mike_Finney_119's avatar
    Mike_Finney_119
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2013
    OK, a little progress. I was able to make the silent non-interactive connection work with "f5fpc -start /c "C:\Program Files\F5 VPN\client.f5c" /p password /t /q", but I haven't been able to figure out a good way to retrieve the session ID to run with the "f5fpc -stop /s ID" command. I did have to use the logon page to accept the credentials but as long as the user doesn't see the connection then it is fine. Is there a good and easy way to end the sessions remotely? I guess I could put a connection limit in place and just terminate them after 5 minutes or something, but that seems a bit excessive when there is a command line option -stop.
  • Mike_Finney_119's avatar
    Mike_Finney_119
    Icon for Nimbostratus rankNimbostratus
    Dec 04, 2013
    Last one for the day. I found the alias settings in the edge client configuration from the F5 connectivity profile page and thought A-ha! Unfortunately it isn't so easy. I thought that alias = "favorite name" as the f5fpc.exe program in the edge client shows you can use f5fpc -stop /n [favorite name], but it evidently isn't the same value since the client VPN isn't being stopped. Does anyone know of another way to stop the VPN session by a command line using f5fpc.exe or any other way? Thanks!!!
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Dec 06, 2013

    Is there an option to display the session ID? If so could you not capture that in a variable and then reference it when using '-stop'?

     

  • DannyG_34437's avatar
    DannyG_34437
    Icon for Cirrus rankCirrus
    Sep 25, 2014

    Older post, but I've done something similar.. I was able to use the following command on a windows machine to accomplish what I needed:

     

    taskkill /F /IM f5fpclientW.exe

     

    Thanks, dg

     

  • Mike_Finney_119's avatar
    Mike_Finney_119
    Icon for Nimbostratus rankNimbostratus
    Sep 25, 2014

    Hi Danny,

     

    This looks just like what I needed, thanks! Now I can have these client connections go through the F5 and not through the MS VPN.

     

    Mike

     

  • Rich_M_138850's avatar
    Rich_M_138850
    Icon for Nimbostratus rankNimbostratus
    Jun 18, 2015

    Killing the process leaves the session still established on the server. Try the below using powershell to retrieve the sid, create a variable and stop the client using the variable.

     

    PS > cd C:\Program Files (x86)\F5 VPN

     

    PS > .\f5fpc -start /h /u user /p password /q

     

    PS > unattended command here

     

    PS > $e = (.\f5fpc -info | findstr /r ^[1-9] | ForEach-Object {$_.Substring(0,7)})

     

    PS > .\f5fpc -stop /s $e

     

    Rich