topic Re: VPN Machine Authentication in Network Access Control

VPN Machine Authentication

Terry — Fri, 21 Feb 2020 18:36:22 GMT

Current setup:

Anyconnect clients establish VPN tunnels to an ASA and are authenticated using an OTP server and AD (primary and secondary configuration under the connection profile). For AD, the ASA sends the authentication request to ISE which is integrated with AD. Clients are associated to different group-policies depending on which AD group they belong to.

We would like to add machine authentication to this, is is possible to additionally check that the client machine is also present and active in AD?

Kind Regards

Re: VPN Machine Authentication

Rahul Govindan — Thu, 19 Oct 2017 13:48:19 GMT

You cannot pass machine credentials through VPN as it does not do 802.1x for VPN access. But instead, you can run posture (ASA or ISE Posture) to check for a registry key on the user machine.
An example using ASA posture (and DAP for enforcement) is given here:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115947-dap-adv-functions-00.html#anc21

The registry key you can use to check this is "\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain"

You can set up the same check using ISE posture. Example here:
https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117693-configure-ASA-00.html

Re: VPN Machine Authentication

Terry — Fri, 20 Oct 2017 08:29:05 GMT

Thanks for your reply Rahul.

We had already tested the ASA posture / registry key option which worked fine.

My customer asked the question, so I just wanted to make sure I wasn't missing an option that could be used.

Kind Regards

Terry

Re: VPN Machine Authentication

fatalXerror — Wed, 17 Oct 2018 05:15:33 GMT

Hi @Rahul Govindan, i tried to search over the internet about VPN 802.1x for machine certificate authentication then I saw this post. Can you provide me a link that tells that 802.1x VPN with machine certificate authentication is unsupported? thanks

Re: VPN Machine Authentication

Rahul Govindan — Wed, 17 Oct 2018 12:11:38 GMT

@fatalXerror: VPN does not use 802.1x. The machine credentials I was referring to was the credentials the machine uses for 802.1x prior to user login (created when machine joins the domain). You can definitely do client certificate authentication using machine certs with the ASA and AnyConnect VPN client.

Re: VPN Machine Authentication

karenmar — Fri, 20 Jan 2023 02:39:45 GMT

is there any similar solution for MAC computer?

Re: VPN Machine Authentication

ahollifield — Fri, 20 Jan 2023 15:48:22 GMT

What do you mean? This thread addresses that 802.1X is not used on Remote Access VPN. What are you trying to accomplish? MacOS has no concept of a "Machine Account"