ASA 5510 and RSA - Is there a way to make sure that a PC connecting is trusted?

Question

We are currently in the middle of implementing a BYOD policy. Our major opponent is that currently, anyone can hit a site we host publicly and download an cisco VPN software, install it, and with their RSA token + Username/Password use this non-company laptop to access our network.

We currently run a Cisco ASA 5510 for our VPN and RSA as our authentication.

Is there a way using the Cisco ASA 5510 that we can ahead of time have our users by email register their computers with us (Mac Address, secure certificat, etc. yes I know mac's can be spoofed) and we can enter them into configs to only allow connections from said physical addresses or some other identifier.

We can do this via software or ASA configs. Pretty much open to any suggestions at this time.

Answer 1

You could use PKI in your authentication which would require assigning certs to devices. This is covered under the AnyConnect Essentials license. One thing to note, I have never gotten any ASA to accept any certs encrypted with higher than 2048 bits. This may have changed in releases newer than 9.1.2 though.

A more in depth option would be using the Host Scan and Posture Module of AnyConnect. This requires the AnyConnect Premium license and depending on which options, it may require further licensing. This gives you more control and you can limit access to systems with specific registry keys, BIOS serial numbers, OSes, AntiVirus, Firewalls, etc.