How to avoid 3th Party VPN Client

[Coketo]

Hi,

After some security updates, certain VPN clients using Linux OS and the SNX connector (without Mobile Access Blades, just IPsec VPN) were unable to complete the MFA process using OTP. This issue was resolved by having users access the Mobile Access Portal through Chrome on their Linux devices and use the SNX client to receive the OTP and connect.

However, during this process, some users discovered they could use third-party software clients to establish VPN connections with MFA by using alternative client software.

The third-party client being referenced is available at:
https://github.com/ancwrd1/snx-rs

The concern is: how can I prevent access from non-official clients, especially when their logs appear as "EndpointClient," similar to those of users who use the official Endpoint Client to connect?

Best Regards,

[the_rock]

Apart from SCV feature, maybe below can help? You can use access roles for it, but you do need identity awareness blade enabled.

Andy

[Coketo]

It looks interesting I'll investigate more about this, thanks

[the_rock]

I never personally tested it myself, but I am pretty sure it would work.

Andy

[PhoneBoy]

Short of disabling SNX as an allowed client (which would also disable the official SNX client), not sure of a way to do this.
I would open a TAC case.

[Coketo]

Yes, but I need to keep linux users that uses snx.. One particular issue with this unofficial client is that it appears as official EndPointClient on Windows in the IAw logs 

[PhoneBoy]

Completely understand.
As I said, best to open a TAC case.
I’m also checking with R&D on the backend.

[the_rock]

Thats super valid point.

[ancwrd1]

Hi, I am the author of the mentioned 3rd-party software. The only reason why it exists is the lack of the proper VPN client for Linux which is comparable to the one for Windows or macOS.
Security by obscurity will never work so trying to block it is waste of time and a pointless exercise (why? because the protocol is reverse-engineered).
If you have specific wishes for the logging please open a bug ticket in github.