Forum Discussion

Trever_Brackett's avatar
Trever_Brackett
Icon for Nimbostratus rankNimbostratus
Apr 26, 2010

Remediation Website

Hello,

 

 

In a nutshell I'm trying to create a remediation website for users on corporate laptops that have corrupted their AV software and cannot get connected to our corporate Firepass to reinstall the AV software. My idea was this:

 

 

User logs on to the corporate Firepass and gets denied because of AV software. A error message tells them to go to http://www.company.com/tools which would be a landing URI. Here comes the first problem, how to make the pre-logon sequence recognize that the user is coming in on the /tools landing URI and bypass the AV checks.

 

 

So say this is possible then the next step would be when the user gets a logon prompt and enters their credentials they will be presented a webtop. Here is the second problem, how to only give them a web application tunnel link to an internal website that has the AV software on it?

 

 

What I have done so far on my test lab Firepass:

 

1. Created /tools landing URI

 

2. Created a separate master group for authentication with /tools Landing URI access only

 

3. Created a remote tools resource group

 

4. Added remote tools resource group to the master group.

 

5. Disabled "Allow resource groups to be assigned to this master group using global dynamic resource group mapping."

 

6. Under Dynamic Group Mapping - Put the new master group above the Default master group. This caused a problem for normal users because now they would be denied access because of the wrong landing URI. If I put the default master group above the new master group then the user would get their normal links which is not desired.

 

 

I'm completely open to ideas and suggestions and hope what I've stated above makes sense.

 

 

Thanks,

 

Trever
BIG-IP Access Policy Manager (APM)
remote access
security
  • Mike_61719's avatar
    Mike_61719
    Icon for Cirrus rankCirrus
    Apr 26, 2010
    Ok, I will try to answer each one.

     

     

    Since you created the URI, I will skip that one.

     

     

    Two major players here. The first is the pre-logon sequence and the other is protected configuration.

     

     

    PRE-LOGON SEQUENCE

     

     

    Go into the Pre-Logon sequence and add a custom variable like so session.network.server.land_uri == "antivirus"

     

    Then you can add custom rules to the sequence after you have the custom variable i.e. virtual keyboard, os check etc...

     

    At the A/V check failure, add a redirect to the URI you created. In this case it will be antivirus.

     

     

    PROTECTED CONFIGURATION

     

     

    Go into the protected configuration piece on Firepass and add a custom check. Example here: session.network.server.land_uri == "antivirus" name it antivirus download.

     

     

    WEB APPLICATION

     

     

    Create a web application with the URL being an internal link to the A/V software. Add the antivirus download protected configuration.

     

     

    -------------------------------------------------------------------

     

     

    Now all users who access the URI will have access to the single link you just now created if they type in https://firepass.com/antivirus