Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 8 replies
  • Subscribers 27 subscribers
  • Views 7146 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN - Authentifizierung des Client-Geräts möglich?

WaldemarWalter

Hallo zusammen,
bei uns gibt es folgende Anforderung. Wenn sich ein Benutzer mit einem geschäftlichen Notebook (Windows) am VPN anmeldet, dann darf er auf besonders schützenswerte interne Daten zugreifen. Wenn er sich aber mit einem privaten Gerät am VPN anmeldet, dann soll sein Zugriff beschränkt sein. Kann man das mit einer Sophos UTM lösen? Die besonders schützenswerten Daten liegen auf einem extra Server. Dadurch kann der Zugriff darauf über dessen IP in der zentralen Firewall gefiltert werden.

Ich habe gesehen, dass man mit IPsec-VPN eine Zertifikatsanmeldung einrichten kann. Aber das digitale Zertifikat liegt in Form einer Datei vor und kann somit vom Benutzer leicht auf andere Geräte kopiert werden.

Für Tipps wäre ich sehr dankbar!



This thread was automatically locked due to age.
Parents
  • 0

    I do not think MAC filtering will work because the MAC is lost as soon as a packet is forwarded.

    I think you need a "Network Access Control" product.   Microsoft servers provudes one tbat I have looked at briefly and I think is free.   Various vendors provide other options.   That software should be able to tell tbe difference between a domain-enrolled device and a non-domain device.    Then it assigns the device to a VLAN.

    However, reconfiguring your servers to limit accessibility based on client VLAN would still be complicated.

    As an slternative, can you require VPN users to lig onto a RDP server to obtain access to the specisl servers?  If you configure the RDP setver to block client drive sharing and client USB sharing, the RDP server should be well protected from an infected client device.

Reply
  • 0

    I do not think MAC filtering will work because the MAC is lost as soon as a packet is forwarded.

    I think you need a "Network Access Control" product.   Microsoft servers provudes one tbat I have looked at briefly and I think is free.   Various vendors provide other options.   That software should be able to tell tbe difference between a domain-enrolled device and a non-domain device.    Then it assigns the device to a VLAN.

    However, reconfiguring your servers to limit accessibility based on client VLAN would still be complicated.

    As an slternative, can you require VPN users to lig onto a RDP server to obtain access to the specisl servers?  If you configure the RDP setver to block client drive sharing and client USB sharing, the RDP server should be well protected from an infected client device.

Children
No Data