We currently run a Cisco ASA 5510 and a RSA token to authenticate users to our network for VPN access. The company is trying to start BYOD but would like to make sure that the PC has been approved by corporate before hitting our network. This is not something that is currently in place as anyone with an RSA token and Username/Password can install the cisco connect software on any PC they own and VPN in.

We currently employ AD in our network, RSA, and the ASA5510 is the device serving the VPN connection.

TL:DR, We would like to be able to effectively identify a users PC before allowing that PC (if its not authorized) to hit our network via VPN.

  • You would seem to require an agent-based solution. You install the agent on the approved devices and only those can connect.
    – schroeder
    Aug 13, 2014 at 21:26
  • Why do you want to approve the device along with the user? What problem does that control address? If the user can walk out with the device, (because BYOD), then what is mitigated by limiting what is used?
    – schroeder
    Aug 13, 2014 at 21:29
  • We limit the workers ability to install the client and connect on say, a library PC that isn't running our corporate symantec AV. Apart from the aforementioned I am unsure what is the ultimate justification. It may have to do with PCI compliance. We looked into IBM endpoint manager, its an agent based solution but would take too much tweaking to be viable.
    – HAL
    Aug 14, 2014 at 0:40
  • 1
    Chromebooks only, that's what I say. Aug 14, 2014 at 5:50

1 Answer 1


There are agent-based NACs that will not allow a device to connect to a network unless certain conditions are met, like:

  1. Certain other software installed, like AV
  2. User is part of the approved user set
  3. Security settings are configure a certain way
  4. etc.

These require a lot of management and enrolling new devices can be a bit of a pain, but these types of systems do provide what you are looking for. You say that the IBM system would take too much configuration to work, and I suspect that you'll find the same problem with most of them.

There are agent-less systems that use a combination of MAC, OS patch level, and WMI info to and determine if a device is permitted, but they have varying levels of success. I have used one to great effect, but it, too, took a lot of management.

  • Can you name your solution? We can atleast see a demo of the system.
    – HAL
    Aug 14, 2014 at 20:27
  • 1
    Product recommendations go stale, but since you asked: Netclarity.
    – schroeder
    Aug 14, 2014 at 22:06
  • And this will block VPN users?
    – HAL
    Aug 15, 2014 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.