CSA - External Access Policy

Question

Greetings!
Guys, I need some help. One of our customers bought the CSA solution in order to protect and narrow Internet access when an employee is out of the office.
Here is the scenario: If an employee takes one of the company's laptop to his house/hotel/etc and try to access any Internet based service(HTTP, HTTPS, P2P, FTP, Torrent, etc) it is MANDATORY that this person establish a VPN connection, this way all content will be processed by the company's Proxy and Firewall, there isn't split tunnel policy; otherwise all TCP/UDP stream should be BLOCKED.
I'm using the Roaming - Force VPN(action: Query the User, when: MC unreachable & Ethernet Active and NOT when: MC is reachable) and the Cisco VPN Client Rule Modules; there is no Temporary Allow Web Browser rule enabled. But I need some help with the parameters, what happens is that if the user answer yes(allow) to the Query message and does not have a VPN Connection he still manages to access the internet and that's not acceptable.
I need to BLOCK ALL UDP/TCP stream at first, ask the user if the VPN is established, check the status of the VPN connection and then, if is tunnel is UP allow access else block everything until the VPN is established.
Can you guys help me?
Thanks in advance!
Att, Daniel Yamashita
PS: I'm using CSA MC v.5.2.0.263 hot fix(fcs-csamc-hotfix-5.2.0.263-w2k3-k9.zip)

Answer 1

Greetings "followurself",
Sorry taking this long to answer but yes, I've managed to deploy the CSA as our customer wanted.
I've decided to create my own Rule and Policy Modules. I'm not sure if this is what you need but here is a simple sketch:
CSA-External Access Policies
[Rule Modules >> Windows Rule Modules]
-Name: External_Access
-Operating System: All Windows
-State Conditions: Apply this rule module only if the following state conditions are met
\> When: Ethernet Active and Management Center Not Reachable
\-> Not when: Management Center Reachable
[Rules]
(1)Terminate All
*Type: Network Access Control
*Action: Priority Terminate Process (take precedence)
*When ...: Active FTP Client Applications, Active HTTP Client Applications, Active TCP Client Applications, Active UDP Client Applications, Active UDP Server Applications, Active TCP Server Applications, Instant Messenger Applications
*But not in ...: Cisco VPN Client, Web Browser Applications
*Attempt to act as a client or server for network services: $Ephemeral Port Ranges, $TCP, $TCP Ephemeral server ports, $UDP, $UDP Ephemeral server ports
*Communicating with host addresses: $All_But_Private_Local >> Matching: but not: 10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, 192.168.0.0-255.255, @(local)
*Using these local interfaces:
(2)Priority_Deny-Everything but http,https to local and VPN Peer
*Type: Network Access Control
*Action: Priority Deny (take precedence)
*When ...: Active TCP Client Applications, Active UDP Client Applications
*But not in ...: Cisco VPN Client
*Attempt to act as a client for network services: $FTP Control Channel, $HTTP, $Instant Messenger Protocols, $UDP Ephemeral server ports, $TCP Ephemeral server ports, $FTP Client Data Channel, $Email, $DNS, $ALT-HTTP
*Communicating with host addresses: $All_But_Private_Local
*Using these local interfaces:
(3)Allow Web Browser only to Private Range
*Type: Network Access Control
*Action: Priority Allow (take precedence)
*When ...: Web Browser Timed (custom class, $Web Browser Clients with Remove process from application class after 30 seconds)
*But not in the following class:
*Attempt to act as a client for network services: $DNS, $HTTP, $ALT-HTTP
*Communicating with host addresses: $Only Private Local and VPN Peer IP Addresses >> Matching: 10.0.0.0 10.255.255.255, 172.16.0.0-172.31.255.255, 192.168.0.0-255.255, @(local)
*Using these local interfaces:
(4)Warning Message: VPN in NOW
*Type: Network Access Control
*Action: Query User(take precedence) | Query Settings: Establish VPN Connection(Allowed actions = Default Action = Logged = Allow)
*When ...:
*But not in the following class: Cisco VPN Client, MS Logon Setup Applications, MS winlogon
*Attempt to act as a client or server for network services: $TCP Ephemeral server ports, $TCP, $UDP, $UDP Ephemeral server ports
*Communicating with host addresses: $All but 127.0.0.1 >> Matching: but not: 127.0.0.1 && @(local)
*Using these local interfaces:
The Kit generated contains the following groups: + Desktop_All_Typed_Edited (Base Permission + Agent UI Control Disabled +Virus Scanner Module) + External Access.
As you can see the trigger for these rules is the Ethernet Active and if the MC Server is reachable or not. The only way the Pop-Up message could appear is when the MC is unreachable.
I might've mapped a little too much but I it worked great! Let me know if this is what you need. Remember that you should worry more about what to deny than to allow ok?
If there is anything else, don't hesitate to ask.
Regards, Dan