topic Re: Moving from workstations to Laptop on Domain in SASE and Remote Access

Moving from workstations to Laptop on Domain

smohammed — Mon, 03 Aug 2020 17:51:31 GMT

We have currently workstations in office. For remote work we use Laptop as a tool to do VPN and RDP to workstations. We want Laptops to be on domain rather than using to it to do RDP.

now to have this feature working how should be the rules configured? currently to access servers rules are configured IP based. Now when Laptops will move to domain everytime user will do VPN it will have a new officemode IP. We dont have identity awareness blade enabled.

I also have doubt that do we need additional server other than management server for Smart Endpoint?

Please help me

Re: Moving from workstations to Laptop on Domain

PhoneBoy — Mon, 03 Aug 2020 19:26:05 GMT

SmartEndpoint isn't required here at all, but enabling Identity Awareness will definitely be a good idea.
You could actually create two different Access Roles here:

One that is just specifies the relevant networks/hosts (optionally tie it to specific AD groups)
Another that is Remote Access users

Make sure Remote Access is a valid identity source in the gateway/cluster object:

Note the reason I am suggesting an Access Role for the networks versus just using the network objects is because you generally can't mix regular network objects and access roles in the source/destination field of a rule.
Believe this limitation is removed in R80.40.