I work in the cybersecurity division of my employer in a regulated field.
Where I work, edge perimeter controls on firewall are set up to DENY All incoming connections originating in blacklisted countries (e.g: North Korea). If an employee has exceptional need to remotely connect to corporate network, such as when traveling, individual case by case review is required from cybersecurity management prior to whitelisting the connection. Additional conditional access rules via NAC are set up to ensure BYOD devices connecting remotely from potentially untrusted locations have a minimum security baseline.
Quite a while ago, we had a security incident in which an employee traveling was actually working in a blacklisted country, but from which access to our network was not blocked due to use of an unauthorized personal VPN (rather than company VPN) to hide source IP address.
Does NAC have ability to detect traffic that originates under an VPN IP rather than a true IP being masked by the VPN tunnel?
Other than whitelisting the authorized company VPN , can NAC or other technical controls be used to block personal VPN connections?