Global Protect VPN only on domain joined devices

[R.Kniger]

Hello

we are using SCM for our NGFWs and try to connect via Global Protect.

Using Radius Auth we can login with any client/os we those, but we want only domain joined device (w11,ios,ipad) to be connected via VPN.

Where we must configure SCM to look at M365 for company devices?

Kind regards

[BPry]

@R.Kniger,

There's a lot of different ways to accomplish what you are looking for. You could make a machine certificate check against a certificate profile if you're issuing out machine certs, setup a custom check against a registry key like 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\ to ensure that it's joined to your tenant. This is the cleanest way of accomplishing something like this since they won't be able to even connect if they don't meet your criteria since they won't match a profile.

You could also do all of this through HIP checks and a HIP Profile so that you could drop any traffic matching a profile that indicates the machine isn't joined to your domain or associated to your Azure tenant. Unless you utilize this information in your config selection match criteria and make it so non-domain endpoints don't have a config selection, this would facilitate people connecting with a non-domain machine but you would have a "drop" rule that matches your new non-domain joined HIP profile to drop all of the traffic which matches from that endpoint.

I'd also personally look at improving user experience a bit if you're only using issued devices and not solely using RADIUS authentication for this sort of setup. I would use a SAML connection and enable single sign on if these devices are already joined to your tenant. That way you can also utilize conditional access policies on the Entra side of things to lock this down even further. 

[R.Kniger]

We have activate certificatprofil in the agent-app configuration, but this only stops windows client company/private to connect, iPad company/privat can connect. Or where we must set the agent app certificatprofile with our ROOT and ISSUNG CA?

Registry would only help againt Windows, at the moment we distribute the GP IP/FQDN with registry GPO

We had a HIP rule after the GP connect rule but it wasen't used or HIT-Count dosen't grow and we don't see any HIP-Match in Monitor on the local FW.

Or did we use HIP wrong?

I'm not really familiar with SAML, but i ask my support if he done this befor on local configurations

Kind regards

[R.Kniger]

We have found the first issue, Radius Auth was in "user OR client zertifikat" mode not both.

For the moment we can work with this, but if someone copy the certificats to his privat device it is a new corporate device.

But now the corparate iPad won't connect, RootCA is visible under configuration and ISSUING is rolled out over intune but it won't connect