Restrict VPN connection from untrusted devices

[Just_Crj]

Hi there!

We often receive requests from our customers who want to perform secure remote work using the Harmony Endpoint agents, following the ZTNA principle. After the agents have been installed on users' devices and all policies have been configured, it is necessary to allow VPN connections only to HEP agents and to prohibit connections from other VPN clients (standalone clients without the point protection functionality).

However, there is no "Harmony Edpoint" checkbox in the "VPN Clients" setting on the VPN gateway:

To allow VPN connections to HEP agents, we need to activate the Endpoint Security VPN option. However, by doing so, we also enable the connection of standalone vpn clients, which violates the principle of ZTNA.

But there is a solution that will help you😉

The Windows computer on which the HEP agent is installed has a specific registry key value:

This value distinguishes the HEP agent from other standalone clients. To verify the value of this key, we need to configure an SCV check on the VPN gateway, here is the syntax:

: (RegMonitor
	:type (plugin)
	:parameters (
		:string ("HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\CheckPoint\TRAC\client_sub_type=EndpointSecurityIntegrated")
		:begin_admin (admin)
			:send_log (alert)
			:mismatchmessage ("Access denied. You must use the Harmony Endpoint client.")
		:end (admin)
			)
		)

You also need to change the value of the parameter :disconnect_when_not_verified in SCVGlobalParams to true. After installing Access and Desktop policies, standalone VPN clients will no longer be able to connect to the gateway. These are the logs of these incidents that you can find in the SmartConsole:

But SCV only works with Windows. What about other operating systems?

Let's take macOS as an example. In this implementation, a standalone client running on macOS will be able to connect to a VPN gateway, but traffic from the client to internal resources will be dropped according to the SCV policy:

However, the HEP Agent on macOS will be able to connect and access internal resources, as the HEP agent's own Compliance blade on macOS has priority over SCV checks by default:

This implementation is discussed in more detail in this video, just turn on the english subtitles:

I hope this information will be helpful for you!

[PhoneBoy]

Well done!
FYI, we added support for SCV on macOS in the most recent E88.50 release.

[Just_Crj]

Sounds great!