How to avoid 3th Party VPN Client

[Rober506]

Hi,

After some security updates, certain VPN clients using Linux OS and the SNX connector (without Mobile Access Blades, just IPsec VPN) were unable to complete the MFA process using OTP. This issue was resolved by having users access the Mobile Access Portal through Chrome on their Linux devices and use the SNX client to receive the OTP and connect.

However, during this process, some users discovered they could use third-party software clients to establish VPN connections with MFA by using alternative client software.

The third-party client being referenced is available at:
https://github.com/ancwrd1/snx-rs

The concern is: how can I prevent access from non-official clients, especially when their logs appear as "EndpointClient," similar to those of users who use the official Endpoint Client to connect?

Best Regards,

[the_rock]

Apart from SCV feature, maybe below can help? You can use access roles for it, but you do need identity awareness blade enabled.

Andy

[Rober506]

It looks interesting I'll investigate more about this, thanks

[the_rock]

I never personally tested it myself, but I am pretty sure it would work.

Andy

[PhoneBoy]

Short of disabling SNX as an allowed client (which would also disable the official SNX client), not sure of a way to do this.
I would open a TAC case.

[Rober506]

Yes, but I need to keep linux users that uses snx.. One particular issue with this unofficial client is that it appears as official EndPointClient on Windows in the IAw logs 

[PhoneBoy]

Completely understand.
As I said, best to open a TAC case.
I’m also checking with R&D on the backend.

[the_rock]

Thats super valid point.