What's the best user to block internal users trying to access the internet with a VPN client

[Wasfi.Bounni]

Hi;

What's the best way to block internal users trying to access the internet with a VPN client. I mean I want to disallow all internal users from establishing a VPN while on the "Trusted Zone", whether it is an IP-SEC or SSL VPN.

Kindly

Wasfi

[reaper · Accepted solution]

create an application filter for all encrypted-tunnel applications and put that in a block rule (ssl decryption will be required to catch many of these)

[Wasfi.Bounni]

Thank you.

Wasfi

[hshawn · Accepted solution]

We do this here by just not adding the VPN zone to the outbound NAT policy. There are a few ways you can do it but this works well for us with minimal configuration effort.

p.s. employees can use the internet but vendors we do not allow (each has a seperate and unique zone)

[Wasfi.Bounni]

Thank you 

Wasfi