topic How to limit vpn user account to single machine in SASE and Remote Access

How to limit vpn user account to single machine

r3d888 — Wed, 01 Apr 2020 11:59:21 GMT

The scenario is client doesn't have AD and they want all vpn users to used only their company issued machines/laptops to avoid data loss and maintain data privacy.

May I ask if this is possible?

Re: How to limit vpn user account to single machine

LukeOxley — Wed, 01 Apr 2020 17:34:10 GMT

It is indeed possible using certificate authentication. You'll issue the users certificates generated from the Check Point ICA (this can be done from the user records defined in SmartConsole, which get installed on their machines. These can be used as the sole authentication method, or as part of multiple authentication in conjunction with username and password or something similar. Hope that helps!

Re: How to limit vpn user account to single machine

r3d888 — Thu, 02 Apr 2020 14:04:17 GMT

But still when using certificates, user can used or log to its different machine as he/she have both accounts and certificate.

Re: How to limit vpn user account to single machine

Benedikt_Weissl — Thu, 02 Apr 2020 15:17:15 GMT

You can install the certificate into the computers certificate store in a way that makes it impossible for the user to export the certificate later.

Re: How to limit vpn user account to single machine

LukeOxley — Thu, 02 Apr 2020 15:59:49 GMT

Good tip mate!