njmase Tracker

Re: Using PowerShell to Deploy VMware Unified Access Gateway

njmase — Thu, 02 Feb 2017 23:03:01 GMT

Hi markbenson‌,

I wondered if you could help with some pointers on the Radius piece, as I'm having some issues getting true SSO to work.

Using only "authMethods=radius-auth" have a scenario where the AP's splash screen offers just the 2FA passcode to connect, then the next screen will allow username and {ldapPassword}. With another configuration on the radius side, I can provide {ldapPassword+2faPasscode} in the same string, but on the second screen only allows {ldapPassword}. Neither of these configurations work with the "windowsSSOEnabled=true" setting.

I'm struggling a little to understand whether I need "authMethods=radius-auth && sp-auth" vs changing a configuration on the Radius side to have the environment provide one single login window for users.

Is there a recommended Radius setting you would advise along with parameters to invoke in this deploy script?

Thanks!

Re: Using PowerShell to Deploy VMware Unified Access Gateway

njmase — Fri, 11 Nov 2016 17:54:07 GMT

Thanks Mark,

It took 2 sets of eyes, but you are correct..a simple blank space after the ip0=x.x.x.x line caused this error.

The deployment succeeded after that, so thanks for your help!

I had an additional question on setting TLS levels and ciphers. I can see from the script, you can set honorCipherOrder...is the only way to set a custom TLS level and supported cipher to use the REST API?

Re: Using PowerShell to Deploy VMware Unified Access Gateway

njmase — Mon, 07 Nov 2016 15:10:49 GMT

Hi markbenson,

I'm getting issues when deploying due to a vSphere Network Name error...however this Port Group definitely exists. Additionally I don't believe the log file is being generated by the script when looking to investigate:

Error: Unexpected option: --net:Internet=Portgroup Name

Completed with errors

Access Point deployment failed. Further information may be found in the log file log-appliance_hostname.txt

The error comes back pretty quickly, so I'm not sure this error is valid, and when I print $logfile it says that the logfile does not exist. In the script I see:

$logfile="log-$apName.txt"

Remove-item -path $logfile -ErrorAction SilentlyContinue

..tried commenting out the Remove-item portion but it still looks as though nothing is being generated

Any pointers would be appreciated!

Thanks