topic Re: Endpoint Security VPN - 2FA in SASE and Remote Access

Endpoint Security VPN - 2FA

Jonathan_Griffi — Wed, 22 Apr 2020 17:06:04 GMT

Hi all,

Regarding Endpoint Security VPN client /blade...just wondering if anyone knows if there is a plan in the road map to use machine based certs with Radius as a 2FA pairing? It would be a great way of validating machine and user during the authentication process. I've read R80.40 is introducing machine based cert authentication, but based on current features; certificates with 2FA for Endpoint Security VPN is pretty limited as in no 2FA supported at all: sk86240

Essentially, I would love the ability to be able to validate the machine and user during the authentication phase.

From a machine compliance point of view SCV and compliance blade checks seem like they have the ability to check certain elements like reg keys etc, but ( from my limited understanding) is this only covers managed devices. Happy to be educated on this point if this isn't the case 🙂

Thanks,

Jon

Re: Endpoint Security VPN - 2FA

PhoneBoy — Fri, 24 Apr 2020 19:47:08 GMT

Endpoint Compliance is more geared for managed devices, given that it's more tied in with the larger Endpoint solutions we offer.
However, I'm not aware of a reason you can't use it for unmanaged devices as well, aside from the fact you need a full Endpoint client for each client it's installed on.

SCV was created before we had a full Endpoint solution and will work on unmanaged devices.
It will also work with Mobile Access licenses, which are "per concurrent user."

As for the roadmap question, I'll have to ask folks in R&D to comment on that.

Re: Endpoint Security VPN - 2FA

PhoneBoy — Fri, 24 Apr 2020 21:14:08 GMT

It seems that Machine Cert + RADIUS should be a supported combination in R80.40.

Re: Endpoint Security VPN - 2FA

Jonathan_Griffi — Fri, 01 May 2020 22:43:32 GMT

Thanks for the update....look forward to putting this combo into action. Nice one.

Cheers,

Jon