I have a request from business where they need to have this feature which only allows users to connect to remote vpn only if they are using company provided laptop and restrict them if they use their personal laptop.

Any suggestion how can I achieve this?

  • 1
    It's possible, but it;s complicated to set up, and may not be practical for smaller organizations. Can you provide more details about the business?
    – Ron Trunk
    Jan 31 '17 at 17:00
  • Hi @RonTrunk not sure what you mean by more info about business. Well I am referring business here to one of our product team.
    – Rsingh
    Jan 31 '17 at 17:03
  • 1
    How many remote users do you have? How many users overall? What systems, if any, do you have to authenticate users on your network? Do you have wireless networking? If so, how are they authenticated? Any solution has to integrate with your existing security systems.
    – Ron Trunk
    Jan 31 '17 at 17:06
  • 1
    Is you network based on Microsoft Active Directory? If yes it can be done with Microsoft Remote Access Server and Network Policy Server.
    – JFL
    Jan 31 '17 at 17:13
  • @JFL Thanks for the advice, but I want to know this on network side.
    – Rsingh
    Feb 2 '17 at 5:12

If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't have the domain administrator credentials necessary to join his/her personal laptop to the domain, this will prohibit the personal machine from connecting to the network via the VPN. Since you mention Cisco AnyConnect, this can be configured to authenticate the VPN connections via Active Directory, however the exact steps vary depending on the version and type of VPN gateway, as well as the version of Windows Server in use.

Another step would be to implement MAC based filtering, to only allow certain MAC addresses access, although this would involve recording the MAC addresses of every device that needs access (And should not be the only method of access control as MAC addresses are not difficult to spoof)


After a further discussion and readings on this, found that we can do these configurations and set authentication with one factor for certificate or two factor authentication where it uses AD and certificate for authentication.

Now these certificates can be circulated based on AD group policies where a group users/machines can be bind. Or the manually distribute them and install them

you can use both a local CA client certificate or if you wish to get it from external trusted CA you can go for that also.

The configurations can be changed for both legacy remote vpn where you would change authentications in IKE component or webvpn (ssl vpn) where you simply mention the authentication type.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.