0

I have a request from business where they need to have this feature which only allows users to connect to remote vpn only if they are using company provided laptop and restrict them if they use their personal laptop.

Any suggestion how can I achieve this?

7
  • 1
    It's possible, but it;s complicated to set up, and may not be practical for smaller organizations. Can you provide more details about the business?
    – Ron Trunk
    Jan 31, 2017 at 17:00
  • Hi @RonTrunk not sure what you mean by more info about business. Well I am referring business here to one of our product team.
    – Rsingh
    Jan 31, 2017 at 17:03
  • 1
    How many remote users do you have? How many users overall? What systems, if any, do you have to authenticate users on your network? Do you have wireless networking? If so, how are they authenticated? Any solution has to integrate with your existing security systems.
    – Ron Trunk
    Jan 31, 2017 at 17:06
  • 1
    Is you network based on Microsoft Active Directory? If yes it can be done with Microsoft Remote Access Server and Network Policy Server.
    – JFL
    Jan 31, 2017 at 17:13
  • @JFL Thanks for the advice, but I want to know this on network side.
    – Rsingh
    Feb 2, 2017 at 5:12

2 Answers 2

1

If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't have the domain administrator credentials necessary to join his/her personal laptop to the domain, this will prohibit the personal machine from connecting to the network via the VPN. Since you mention Cisco AnyConnect, this can be configured to authenticate the VPN connections via Active Directory, however the exact steps vary depending on the version and type of VPN gateway, as well as the version of Windows Server in use.

Another step would be to implement MAC based filtering, to only allow certain MAC addresses access, although this would involve recording the MAC addresses of every device that needs access (And should not be the only method of access control as MAC addresses are not difficult to spoof)

0

After a further discussion and readings on this, found that we can do these configurations and set authentication with one factor for certificate or two factor authentication where it uses AD and certificate for authentication.

Now these certificates can be circulated based on AD group policies where a group users/machines can be bind. Or the manually distribute them and install them

you can use both a local CA client certificate or if you wish to get it from external trusted CA you can go for that also.

The configurations can be changed for both legacy remote vpn where you would change authentications in IKE component or webvpn (ssl vpn) where you simply mention the authentication type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.