Requiring a certificate for security policy to control access

[RhinoNetAdmin]

I have been tasked to lock down access to our devops environment for developers over VPN. Developers using non-corporate assigned assets (workstations & laptops) will only be allowed access to their desktop workstations in-house over RDP. Developers using corporate assigned assets can access all services on the devops network (source repos, wikis, project tools, ...).

I was hoping to be able to install and require a locally generated certificate from our CA on the corporate assets, and block access to everything other than RDP on the devops network. I don't see a way to do this. Is this possible? If not, is there a better approach?

I thought of creating a AD group with workstations that are permitted, but it is too easy to change the name of a workstation by the user. The certificate has the advantage that I can revoke it or have it expire, requiring the developer to contact the IT support to resolve.

Any ideas or suggestions are appreciated.

-Freeman Pascal

[BPry]

@RhinoNetAdmin,

Two ways off hand that you could accomplish this:

HIP-Profile (Requires GlobalProtect Subscription):

Create a HIP-Object that simply checks for the required certificate and use that detection to build out an appropriate profile for use in the security rulebase. This is the easiest solution as long as you have a subscription and doesn't require any major modifications.

New Gateway: 

Assuming you wouldn't want to add a new Portal configuration specific to these users (although that would be ideal), you could just create a new Portal agent configuration and use that to point them at a new gateway specific to these users with ideally a new security zone. Then just control the new security zone for these users as you want going forward. 

The HIP check is going to absolutely be your best path forward, and I'd argue that if you don't already have that subscription it's something you absolutely should have if you're allowing BYOD to sensitive endpoints. Assuming that you have this subscription and can utilize HIP, this is your best path forward.