Forum Discussion
NimbostratusSSL VPN and Machine Cert Inspection
Hi everyone,
I'm working on implementing an SSL VPN with machine certificate inspection for secure access to VPN resources. However, I'm hoping to achieve this without using an agent, which is why I’m reaching out to the community for insights.
I understand that agentless setups might be limited, but I wanted to confirm if there’s a way to achieve this without endpoint agents. If anyone has experience or guidance on possible approaches, it would be greatly appreciated.
Thanks in advance for your help!
2 Replies
- Injeyan_Kostas
Cirrostratus
You would need at least the plugin to be able to use machine certificate
an equivalent way if you use intunes would be to consume intunes compliance inside your policy 
f51Cumulonimbus
Hello!
Implementing an F5 SSL VPN with machine certificate inspection without using an agent can be challenging but is possible with the right configuration. One approach is to utilize the F5 BIG-IP Access Policy Manager (APM) which supports clientless VPN access and can perform machine certificate inspection. This can be achieved through the use of the BIG-IP APM web portal, where the certificate inspection is managed by the VPN gateway rather than an endpoint agent.
To implement this, you would need to configure the BIG-IP APM to require certificate-based authentication for access to the VPN. During the SSL handshake process, the APM can check for valid machine certificates. This setup will involve careful configuration of your certificate authority (CA) and certificate distribution to ensure that only devices with valid machine certificates can establish a connection.
Additionally, integrating a robust Public Key Infrastructure (PKI) is essential. This will help manage and distribute machine certificates effectively, even in an agentless environment. Ensure that your network policies are enforced to verify machine certificates before granting access, which can be done through the BIG-IP APM’s access policies.
While these approaches can help achieve your goal without endpoint agents, you should be aware of potential limitations in terms of granularity of control and visibility compared to agent-based solutions. Make sure to thoroughly evaluate the security and user experience implications of your chosen method.
