Can a VPN gateway enforce policies in form of checking whether a particular software or set of software is installed on the endpoint and based on that allow / deny the remote connection to be established ?

  • 1
    This comes from a noob and I'm not sure I'm answering your question, but I worked for a company which used Juniper for VPN connections (cannot recall the name) and it required McAfee AV to be installed, otherwise it would not connect. – Augusto Aug 13 at 12:59
  • @Augusto Do you have any more details on that ? – cyzczy Aug 13 at 14:34
  • 1
    Bit of google helped. It look like this is now called PulseSecure host Checker, as Juniper sold their networking products a while ago. Check page 14 of www-prev.pulsesecure.net/download/techpubs/current/416/… – Augusto Aug 13 at 14:47
  • Thank you @Augusto I really appreciate your help! Just wondering whether other vendors have that as well. – cyzczy Aug 14 at 17:31

The Trusted Computing Group (TCG) has defined a set of standards that allow VPN gateways (and other endpoints) to do that in a secure way called Trusted Network Communications (TNC). Many of them have also been released as RFCs by the nea IETF working group and some related ones by the sacm working group.

The following image provides an overview of these protocols/interfaces:

enter image description here

The open source strongSwan IPsec VPN solution implements these protocols and provides many example use cases, for instance, endpoint assessment (e.g. with Linux or partially with Android), or creating software inventories together with the strongTNC application (and the swidGenerator utility). The latter also allows to define policies that are enforced by the VPN gateway (e.g. to only allow restricted VPN access if software updates are missing on a client or other irregularities are found).

There are commercial vendors that implement some of the protocols (e.g. IF-MAP) but they often rely on their own proprietary solutions. For instance, Microsoft provided the Network Access Protection framework, but that has been removed from the latest releases of their operating systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.