topic Re: Standalone Remote Access VPN Client + Posture Checks in General Topics

Standalone Remote Access VPN Client + Posture Checks

HeikoAnkenbrand — Wed, 28 Aug 2024 10:05:22 GMT

Is it possible to perform posture checks with the latest ‘Standalone E88.50 Remote Access VPN Clients for Windows’?

Background to my question:

A customer wants to avoid using the ‘Remote Access VPN client’ on private PC. The user could install the software on his private PC and then set up a VPN tunnel to the company.

Are there posture checks here so that you can check whether the “Remote Access VPN Client” software only works on company PCs?

I had thought of something like this:
- Certificate check whether a company certificate is available.
- Check whether a company registry key is set.
- and and and

Is this possible with ‘Inline Layer’ or ‘Order Layer’?
The idea is to query the user certificate first and then the machine certificate if necessary.

Or perhaps with IA rule to use both certificates (user certificate and machine certificate).

Does anyone here have any ideas?

I have not found anything on this in the following documents:
- R81.20 Remote Access VPN Administration Guide
- Remote Access VPN Clients for Windows Admin Guide
- Remote Access TTM Configuration (sk75221)
- E88.x Remote Access VPN Clients
- E87.x Remote Access VPN Clients

Re: Standalone Remote Access VPN Client + Posture Checks

D_W — Wed, 28 Aug 2024 10:33:09 GMT

Proposal: Allow authentication only with password AND certificate. Only Company Devices receive the cert and you also include a second factor.

Re: Standalone Remote Access VPN Client + Posture Checks

AkosBakos — Wed, 28 Aug 2024 11:33:32 GMT

Hi @HeikoAnkenbrand,

Maybe the Secure Configuration Verification - Advanced can be useful in this situation.

What if you check the logged in user is a DOMAIN user in the companies AD?

"Groupmonitor"

This checks that the logged on user belongs to the expected domain user groups.

Parameter	Description
`"builtin\administrator" (false)`	A name of a user group. The user must belong to this group for the machine configuration to be verified.

Cheers,

Akos

Re: Standalone Remote Access VPN Client + Posture Checks

HeikoAnkenbrand — Wed, 28 Aug 2024 12:44:31 GMT

Hi @AkosBakos,

I was probably blind when reading the manuals 😉

Thank you very much, that's exactly what I was looking for.

Cheers,
Heiko

Re: Standalone Remote Access VPN Client + Posture Checks

the_rock — Wed, 28 Aug 2024 12:53:21 GMT

Thought you could set it below, but guess not, has to be done through local.scv file...

Andy