Restrict a user from Using Anyconnect on personal machines

[Hamed Karimi]

Hi

I need to restrict the anyconnect user to use the company laptop not a personal device to connect with VPN to the network. 
Is there any way to restrict it via ASA or anyconnect settings?

kind of checking mac address or etc

[ngkin2010 · Accepted solution]

Hi,

You may use hostscan and Dynamic Access Policy to check the MAC address.

Ref: https://community.cisco.com/t5/vpn/is-there-a-way-to-filter-mac-address-on-vpn-cisco-anyconnect/td-p/3042193

Alternatively, you may consider to enable client certification authentication for users. You first install certificate on the company's computer by either manually or GPO. User require to use that certificate (on your company notebook) for authentication.

[Marvin Rhoads · Accepted solution]

Note that Hostscan/DAP requires AnyConnect Apex licensing. Also that option is currently restricted to ASA headends. If you use Firepower Threat Defense it's not an option.

In addition to the certificate option, we could also use Cisco ISE on the backend. That works with either ASA or FTD headends.