1

I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access.

(Note: This is a thought-experiment at the moment, but I hope I can implement this at some point). Please also note that I don't have much experience with VPNs.

Here's what I try to do.

I have two networks, my LAN and my DMZ. I want to setup two different VPNs, one for the DMZ to which every client device with valid logon credentials can connect (Laptops, Smartphones, Tablets, etc.) and the other one for the internal LAN where I want to restrict access to certain clients only (e.g. company laptops and towers with encrypted HDDs).

The problem is, IP whitelisting is not an option (I think) since the laptops could connect from home/airport/etc.

I thought about identifying them with ssl client certificates but I only have worked with client certs in browsers so far and those can be exported by the user and moved to another machine.

Hopefully you guys can help we with this. (And sorry, I know this topic has come up a few times but I couldn't find a solution).

EDIT: A colleague mentioned that cisco anyconnect has some kind of client identification feature. I'll look into that. Still, other options and help on this is appreciated!

Improve this question
2
  • Do your users use RADIUS, LDAP or another protocol to authenticate?
    – Mike Mackintosh
    Commented Sep 20, 2013 at 12:11
  • As mentioned, it's a thought-experiment atm. But we do have MSAD, which we could use for VPN.
    – mohrphium
    Commented Sep 20, 2013 at 12:15

2 Answers 2

Reset to default
0

It's quite common that corporate setups use a hidden file to identify the device. Many VPN systems have scripting hooks in the client that they use to verify the hidden file. Of course, this isn't secure against a skilled attacker who has access to an authorised laptop, but it does provide some security. Certificates are an alternative to this.

In principle you could use key verification based on the TPM. I have never actually seen this implemented, so I don't know about the practicalities of doing it. But in principle this is a highly secure way to tie the access to particular hardware.

Improve this answer
0

I'm sorry that we don't know more details about your infrastructure, but basically i would recommend you stay tuned with certificates. Maybe this Video about Client Certificats helps a little.

Another way would be to use Radius Auth or something else (e.g. MSAD)

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .