Cisco AnyConnect, I need to only allow company machines to have VPN access

[KEN COUSINO JR.]

We currently have an ASA 5512 and we are using AnyConnect client for connections.  I need to make sure that only the company machines can connect and not any users personal machines.  We use Radius and Duo for 2FA.  We would prefer to not use certificates if possible.

Thanks,

Ken

[Rob Ingram]

Hi,

What about using DAP to scan windows reigstry for the Domain Registry key in order to determine the domain membership? Alhough I can anyone could just create the key with the correct entry, a domain issue certificate would be as easy to circumvent.

HTH

[KEN COUSINO JR.]

But with DAP you have to use CSD or can you do it without CSD?

[balaji.bandi]

Yes Certicate based authentication also a good option. i have couple of setup done all working as expected.

Hope you have pre-package laptop builds, we setup auto renew every 7days - so security risk can be mitigated.

choose what best option for the coporate policies.