How to limit vpn user account to single machine

[r3d888]

The scenario is client doesn't have AD and they want all vpn users to used only their company  issued machines/laptops to avoid data loss and maintain data privacy.

May I ask if this is possible?

[LukeOxley · Accepted solution]

It is indeed possible using certificate authentication. You'll issue the users certificates generated from the Check Point ICA (this can be done from the user records defined in SmartConsole, which get installed on their machines. These can be used as the sole authentication method, or as part of multiple authentication in conjunction with username and password or something similar. Hope that helps!

[r3d888]

But still when using certificates, user can used or log to its different machine as he/she have both accounts and certificate.

[Benedikt_Weissl]

You can install the certificate into the computers certificate store in a way that makes it impossible for the user to export the certificate later.

[LukeOxley]

Good tip mate!