Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I have a request from business where they need to have this feature which only allows users to connect to remote vpn only if they are using company provided laptop and restrict them if they use their personal laptop.
Any suggestion how can I achieve this?
If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't have the domain administrator credentials necessary to join his/her personal laptop to the domain, this will prohibit the personal machine from connecting to the network via the VPN. Since you mention Cisco AnyConnect, this can be configured to authenticate the VPN connections via Active Directory, however the exact steps vary depending on the version and type of VPN gateway, as well as the version of Windows Server in use.
Another step would be to implement MAC based filtering, to only allow certain MAC addresses access, although this would involve recording the MAC addresses of every device that needs access (And should not be the only method of access control as MAC addresses are not difficult to spoof)
After a further discussion and readings on this, found that we can do these configurations and set authentication with one factor for certificate or two factor authentication where it uses AD and certificate for authentication.
Now these certificates can be circulated based on AD group policies where a group users/machines can be bind. Or the manually distribute them and install them
you can use both a local CA client certificate or if you wish to get it from external trusted CA you can go for that also.
The configurations can be changed for both legacy remote vpn where you would change authentications in IKE component or webvpn (ssl vpn) where you simply mention the authentication type.
