topic How to enforce Antivirus definition compliance on VPN clients in Network Security

How to enforce Antivirus definition compliance on VPN clients

rperera — Fri, 21 Feb 2020 08:09:53 GMT

We are running Cisco VPN3K with vpn clients. I know there is an option to enforce ZoneAlarm firewall compliance. Is there a way to enforce AV signatures?

If the client is not uptodate on the signatures we want to deny the vpn connection.

Re: How to enforce Antivirus definition compliance on VPN client

MARK BAKER — Thu, 26 May 2005 23:24:43 GMT

AV signature verification is possible, but it is not configured on the VPN3K. It is configured on an ACS server and works in conjunction with the VPN3K.

The term for this is Network Admission Control (NAC). It is a relatively new solution and doesn't yet have alot of documentation and may not be compatible with all vendors at this time. The most difficult information to find for me was the vendor-id and product-id for the AV and firewall products. I did receive an email from symantec after a little prying. I haven't yet implemented it and can't say how well it works.

go to www.cisco.com/go/nac for more information.

Hope this helps.

Re: How to enforce Antivirus definition compliance on VPN client

MARK BAKER — Thu, 26 May 2005 23:27:33 GMT

I forgot to mention that you need to be running VPN3K version 4.7 and ACS version 3.3 for the NAC feature. Once you have VPN3K 4.7 installed, you will have another tab under group setup labeled NAC where you configure the options.

Also, the ACS 3.3 userguide describes it's setup for NAC.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:29:50 GMT

Sorry for posting this message a couple of times. My computer froze and I kept clicking on Post and there was no way to delete the message.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:30:24 GMT

Do you know if VPN3K version 4.7 also works with Radius server (Funk Software) to implement the Antivirus check? Do you mind sending me an email to let me know when you implemented the NAC feature? My e-mail address is dianewalker@mail.com. Thanks.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:30:25 GMT

Sorry

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:30:25 GMT

Sorry

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:30:25 GMT

Sorry.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Thu, 02 Jun 2005 00:30:25 GMT

Sorry for posting the messages several times. My computer froze and I kept clicking on Post button and there was no way to delete the message.

Re: How to enforce Antivirus definition compliance on VPN client

MARK BAKER — Thu, 02 Jun 2005 11:18:45 GMT

I will let you know once I have implemented this feature.

I do believe that you need Cisco ACS to make this work, but I am not positive.

If anyone else has implemented this feature already, I would also be interested in hearing more about it.

Re: How to enforce Antivirus definition compliance on VPN client

blackey — Fri, 03 Jun 2005 19:48:28 GMT

The AV signature compliance in the case with Zone Alarm,( checkpoint now), Sygate also has a product, is handled by the Zone labs Integrity agent itself. This isnt the straight PC firewall that they have but a added capability product that has just an agent or the agent and the Zonealarm firewall called Integrity. This product works along with the VPN3000 to enforce a wide range of compliance from AV signatures, to OS version, specific lists of applications that can access the VPN, etc. The new Cisco NAC products have the same capabilities but I havent used them yet.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Sat, 04 Jun 2005 23:08:20 GMT

Thanks for your input. When you implemented Cisco NAC, will you send me an e-mail to let me know how it went? My e-mail address is dianewalker@mail.com. Thanks.

Re: How to enforce Antivirus definition compliance on VPN client

dianewalker — Sat, 04 Jun 2005 23:14:19 GMT

Thanks vey much. I'll wait to hear from you.