I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access.
(Note: This is a thought-experiment at the moment, but I hope I can implement this at some point). Please also note that I don't have much experience with VPNs.
Here's what I try to do.
I have two networks, my LAN and my DMZ. I want to setup two different VPNs, one for the DMZ to which every client device with valid logon credentials can connect (Laptops, Smartphones, Tablets, etc.) and the other one for the internal LAN where I want to restrict access to certain clients only (e.g. company laptops and towers with encrypted HDDs).
The problem is, IP whitelisting is not an option (I think) since the laptops could connect from home/airport/etc.
I thought about identifying them with ssl client certificates but I only have worked with client certs in browsers so far and those can be exported by the user and moved to another machine.
Hopefully you guys can help we with this. (And sorry, I know this topic has come up a few times but I couldn't find a solution).
EDIT: A colleague mentioned that cisco anyconnect has some kind of client identification feature. I'll look into that. Still, other options and help on this is appreciated!