Requiring a certificate for security policy to control access

cancel
Showing results for 
Search instead for 
Did you mean: 

Requiring a certificate for security policy to control access

L0 Member

I have been tasked to lock down access to our devops environment for developers over VPN. Developers using non-corporate assigned assets (workstations & laptops) will only be allowed access to their desktop workstations in-house over RDP. Developers using corporate assigned assets can access all services on the devops network (source repos, wikis, project tools, ...).

 

I was hoping to be able to install and require a locally generated certificate from our CA on the corporate assets, and block access to everything other than RDP on the devops network. I don't see a way to do this. Is this possible? If not, is there a better approach?

 

I thought of creating a AD group with workstations that are permitted, but it is too easy to change the name of a workstation by the user. The certificate has the advantage that I can revoke it or have it expire, requiring the developer to contact the IT support to resolve.

Any ideas or suggestions are appreciated.

 

 

-Freeman Pascal

 

1 REPLY 1

Cyber Elite
Cyber Elite

@RhinoNetAdmin,

Two ways off hand that you could accomplish this:

 

HIP-Profile (Requires GlobalProtect Subscription):

Create a HIP-Object that simply checks for the required certificate and use that detection to build out an appropriate profile for use in the security rulebase. This is the easiest solution as long as you have a subscription and doesn't require any major modifications.

 

New Gateway: 

Assuming you wouldn't want to add a new Portal configuration specific to these users (although that would be ideal), you could just create a new Portal agent configuration and use that to point them at a new gateway specific to these users with ideally a new security zone. Then just control the new security zone for these users as you want going forward. 

 

The HIP check is going to absolutely be your best path forward, and I'd argue that if you don't already have that subscription it's something you absolutely should have if you're allowing BYOD to sensitive endpoints. Assuming that you have this subscription and can utilize HIP, this is your best path forward. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!