topic Limit hours to join VPN Remote Access in SASE and Remote Access

Limit hours to join VPN Remote Access

Julian_Sanchez — Fri, 29 May 2020 19:36:24 GMT

Hi all,

We have an appliance that works Remote Access VPN, now the users connect just fine and it work perfect, but we want limit their access to the VPN , by time. Example: From 08:00 to 18:00 the user can connect to the VPN, before and after that period of time, the VPN must fail to connect.

I think I can use object time on the rule the VPN Remote Access, however, I dont know sure, firts if its allow, and second if this dont cause problems of performance.

I review the options in gateway, and global propierties, and I havent see anything for configure the hour range limit for connect to vpn.

Any advice?

Regards,

Julian

Re: Limit hours to join VPN Remote Access

Maarten_Sjouw — Fri, 29 May 2020 20:21:00 GMT

You will not be able to allow or disallow a VPN to connect.
You can however prevent any NEW connections outside the timeframe from the Office Mode network. When you have multiple rules for the Office Mode network you can add a drop rule above them with a time object that disables the rule from 8-18 hours
Again keep in mind this will only stop new connections, all running connections will not be interrupted.

Re: Limit hours to join VPN Remote Access

Hrvoje_Brlek — Tue, 08 Dec 2020 08:03:12 GMT

Hi,

I have the same question as above, we would just like to allow specific users to connect outside working hours (for example 22.00h - 06.00h). What would be the best approach. We are using Endpoint Security client with gateways running on R80.40 take 87.

Can I set a rule above all that drops a specific AD group (access role) and make it active from 22:00 till 06:00h? (If we clear all the VPN connections at the same time everyday (22:00h) users won't be able to connect afterwards?)
And then below allow the specific AD group (access role) to normally connect all the time?
Or can we do it with disabling AD accounts in Microsoft Active Directory, will this also work or will users stiil be able to connect?

Thanks!