Restrict Remote VPN access for MAC OS X Users

[Sam Almeida]

Hi All,

As the tittle suggests, I need a way to block MAC OS X users connecting remotely to our coporate users over VPN. I know there is an option to block connections based on VPN client Version, but cant find a way to block users based on operating system.

We use Cisco ASA 5510 firewals one with v8.2(1) and other with v7.2(3). I need to do on both firewalls. They are both at diffrent sites.

Help would be greatly appreciated

Thanks,

Sam

[Karsten Iwen · Accepted solution]

You can match on the Operating System in the Dynamic Access Policies. But there are some restrictions. You need the HostScan-License which only works with the AnyConnect Premium license. And if I remember right, the DAPs were introduced in ASA v8, so the older ASA has to be updated (an update would be a good idea anyway).

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Sam Almeida]

Thanks Karsten for reply.

We dont not use AnyConnect. We currently have Remote IPsec connection and have a Security Plus license. Does that cover the HostScan License?

If not are there any other solutions maybe ACL based etc.?

Thanks

Sam

[Karsten Iwen]

The hostscan needs AnyConnect, so there is nothing for the IPSec-Client. Also the ACL is not aware of the OS, so that won't work.

Perhaps you can match on the Client-Version >= v5. The MAC-client is only available in version 4.9.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[Sam Almeida]

Cool, thanks for your help