VPN and ISE Profiling

[Alex Pfeil]

We have requirement to allow users to VPN into our network on work equipment only (no BYOD). Do we have to use posture in order to meet this requirement?

[paul · Accepted solution]

You could do posture, but that would be overkill to simply answer the question "Is this device a corporate asset?"

Configure your VPN head-end to do certificate authentication then send the authentication over to ISE to do User/MFA authentication.  This assumes you have certificates pushed to your corporate devices.  I usually setup two group URLs for my customers:

https://vpn.mycompany.com/vendor

https://vpn.mycompany.com/employee

The vendor group URL does User/MFA auth only, no certificate, but DACLs are applied to limit access to the network based on what the vendors need.

The employee group URL does certificate + User/MFA auth to ensure connecting devices are corporate devices.

[Alex Pfeil]

Is there any way around certificates?

[paul]

If the VPN head-end requires certificates to connect the user/device must present a proper certificate from a CA the VPN device trusts to issue certs. The only way to get around this would be extracting the certificate/private key from one device and move it to another. If your certificate templates allow for private key exporting and you are making it easy to do this then the integrity of your CA is gone.

[Alex Pfeil]

I just meant: is there a way to make sure the device is a corporate device without the certificate?

[paul]

Posturing, but that is way more difficult to configure and support than a certificate check. The certificate check is a trivial setup, assuming you have certs already issues to connecting corporate devices.