topic Re: VPN and ISE Profiling in Network Access Control

VPN and ISE Profiling

Alex Pfeil — Wed, 05 Sep 2018 14:13:52 GMT

We have requirement to allow users to VPN into our network on work equipment only (no BYOD). Do we have to use posture in order to meet this requirement?

Re: VPN and ISE Profiling

paul — Wed, 05 Sep 2018 14:19:17 GMT

You could do posture, but that would be overkill to simply answer the question "Is this device a corporate asset?"

Configure your VPN head-end to do certificate authentication then send the authentication over to ISE to do User/MFA authentication. This assumes you have certificates pushed to your corporate devices. I usually setup two group URLs for my customers:

https://vpn.mycompany.com/vendor

https://vpn.mycompany.com/employee

The vendor group URL does User/MFA auth only, no certificate, but DACLs are applied to limit access to the network based on what the vendors need.

The employee group URL does certificate + User/MFA auth to ensure connecting devices are corporate devices.

Re: VPN and ISE Profiling

Alex Pfeil — Wed, 05 Sep 2018 14:22:15 GMT

Is there any way around certificates?

Re: VPN and ISE Profiling

paul — Wed, 05 Sep 2018 14:25:15 GMT

If the VPN head-end requires certificates to connect the user/device must present a proper certificate from a CA the VPN device trusts to issue certs. The only way to get around this would be extracting the certificate/private key from one device and move it to another. If your certificate templates allow for private key exporting and you are making it easy to do this then the integrity of your CA is gone.

Re: VPN and ISE Profiling

Alex Pfeil — Wed, 05 Sep 2018 14:26:51 GMT

I just meant: is there a way to make sure the device is a corporate device without the certificate?

Re: VPN and ISE Profiling

paul — Wed, 05 Sep 2018 14:30:15 GMT

Posturing, but that is way more difficult to configure and support than a certificate check. The certificate check is a trivial setup, assuming you have certs already issues to connecting corporate devices.