Spliting RA VPN access between domain and non-domain PCs fo domain users

EVSolovyev — Thu, 12 Sep 2024 08:51:44 GMT

Hi there!

I would like to split access for remote users (MAB, RA VPN, 2FA) into domain and non-domain. All users have only MS AD accounts, but they can connect via VPN from a domain or non-domain PC. Depending on whether the PC is in the domain or not, different resource should be available.

For example, if John Doe connects from a domain PC, he can access the [LAN1] resource. But if the same John Doe connects from a non-domain PC, he can access [LAN2].

Can you please tell me if you have such an implementation? If so, how stable is it?

I think all RA resources will be announced into VPN for all users, regardless of whether the PC is in the domain or not. And access to [LAN1] or [LAN2] will be determined by the FW policy, but now I don't understand how to write it....

Re: Spliting RA VPN access between domain and non-domain PCs fo domain users

AkosBakos — Thu, 12 Sep 2024 13:04:57 GMT

Hi @EVSolovyev

What is came into my mind: you are able to determine in the in the Access role the machine(s):

Choose a group of machines (this represents the domain machines)
if the user connects from a machine what is not a domain member (not in the choosen group)
the rule won't applies to it.

This kind of handling 100% stable, as the Access policy. 🙂

There was a same kind of topic recently, have a look at on it:

https://community.checkpoint.com/t5/General-Topics/Standalone-Remote-Access-VPN-Client-Posture-Checks/m-p/224806#M37429

Maybe the Secure Configuration Verification - Advanced can be useful in this situation.

What if you check the logged in user is a DOMAIN user in the companies AD?

"Groupmonitor"

This checks that the logged on user belongs to the expected domain user groups.

Parameter	Description
`"builtin\administrator" (false)`	A name of a user group. The user must belong to this group for the machine configuration to be verified.

Cheers,

Akos

topic Spliting RA VPN access between domain and non-domain PCs fo domain users in SASE and Remote Access

Spliting RA VPN access between domain and non-domain PCs fo domain users

Re: Spliting RA VPN access between domain and non-domain PCs fo domain users