Machine based Access Roles with Office Mode/Remote Access VPN

saulosouza — Tue, 09 Mar 2021 13:28:06 GMT

We have an R80.40 Gateway Cluster with Identity Awareness. The identity sources are AD Query and Remote Access. Mobile Access Office Mode is enabled. User-based access roles work fine for VPN users, but the same can't be said for an access role that defines the machines.

The AD Query is working fine for the other contexts, but it's not applied to VPN connection.

In PDPd and PEPd logs I can see the AD connection for the machine in the VPN, but I think it's not processed by the identity Awareness.

[28237 4059047744]@CPFW01[25 Feb 14:01:17] [TRACKER]: #3326304 -> INCOMING -> ADQUERY_ASSOCIATION ->
Association
ip: 10.18.172.130
user:
machine: dxx-55375
domain: xxx.jus.br
reason:

Is there a way for the Remote Access and AD Query to work together to get the machine identification? What I'm trying to achieve here is to have identified domain machines hit a different rule/layer compared to a machine that remotely connects and is not identified.

Thanks in advance!

Re: Machine based Access Roles with Office Mode/Remote Access VPN

_Val_ — Tue, 09 Mar 2021 14:53:12 GMT

The R80.40 release adds a new VPN authentication capability to Security Gateway. Authentication with a machine certificate as of Endpoint Security Client E80.71 is now available for gateways. Refer to Remote Access VPN R80.40 Administration Guide

Also, highly recommended is sk86240

topic Machine based Access Roles with Office Mode/Remote Access VPN in SASE and Remote Access

Machine based Access Roles with Office Mode/Remote Access VPN

Re: Machine based Access Roles with Office Mode/Remote Access VPN