CLIENT VPN POSTURE AND REMEDIATION

[Doke]

I would like to perform system health checks to clients connecting to our VPN remotely, to make sure at the very least they are compliant with antivirus. Is there any way to do this in Meraki MX100? I believe the answer is no. It appears they have a bad implementation that is Java based for internal wifi connection, however if i am correct if you don't have Java you can blow right by it. I mean can we get a little help here from CISCO ISE? that would be FABULOUS. Please let me know what you all have done to meet this need?

[Terrence]

Under Security appliance, access control

turn on splash page (click-through or sign-on with)

Under the Netwrok acess control section there is an option to check clients for antivirus software

Hope this helps

[Doke]

Yeah that is the Java based implementation i was referring to, if you are on a mac or dont have java installed you can blow by it.

[PhilipDAth]

I have not tried this with VPN ...

If Systems Manager is install you can have group policy dynamically assigned based on the state of things like antivirus.  However it normally does not rectify or update itself very quickly.

Some sample screenshots ("block gambing" is a test policy we use - as well, it is easy to test things but not get in the way of normal business):

[Doke]

These systems will not be on the domain and possibly not accountable to group policy in this aspect.if my brain is working correctly.

[PhilipDAth]

Systems Manager does not care if a machine is on the domain or what your group policy is.  It just checks the machine state.

[Doke]

you meant policy on the Meraki gotcha, i see where you are talking about. it peaks my interest ill take a look at it. guess it boils down to options after the policy is created on what to do with them.