Hey folks, been wrestling with something at the intersection of security and user management that I think a few of you might find useful, especially with hybrid work. We've been rolling out GravityZone for our managed corporate endpoints, but what about those unmanaged personal devices (BYOD) that need to connect via the Bitdefender VPN for specific resources? We needed a way to enforce that *only* devices with the GravityZone client and our specific VPN profile could initiate a connection.
The goal was to make it a conditional access problem: no GravityZone agent, no VPN connection. The GravityZone API and a bit of scripting on our gateway side turned out to be the answer. Here's the basic flow we implemented:
1. **Unique Tagging:** We created a custom tag in GravityZone (`vpn-allowed`) and applied it to all corporate-managed devices. For personal BYOD, we have a manual onboarding process where the user installs the GravityZone agent (in unmanaged mode) and we push the tag remotely.
2. **Gateway Check:** Before a VPN connection is fully established, our firewall (we're using a Palo Alto VM in AWS) runs a pre-authentication script. This script calls the GravityZone API to check if the connecting device's hostname (or a derived identifier) exists in GravityZone *and* has the `vpn-allowed` tag.
3. **Access Decision:** If the check passes, the connection proceeds. If it fails, the connection is dropped at the gateway.
The core of the script is a simple API call. Here's a condensed Python example of the check logic:
```python
import requests
def check_device_in_gravityzone(device_name, api_key):
# Query GravityZone for the device by name
headers = {'X-Api-Key': api_key}
search_url = f"https://cloud.gravityzone.bitdefender.com/api/v1.0/jsonrpc/network"
payload = {
"jsonrpc": "2.0",
"id": "1",
"method": "getManagedEndpoints",
"params": {
"filters": {
"hostName": device_name
},
"withTags": True
}
}
response = requests.post(search_url, json=payload, headers=headers).json()
# Parse response to find the device and check for 'vpn-allowed' tag
if response.get('result'):
for endpoint in response['result']:
if 'vpn-allowed' in [tag.get('name') for tag in endpoint.get('tags', [])]:
return True
return False
```
We've had this running for a few months now. It's not 100% foolproof, but it adds a strong layer of compliance, ensuring a baseline of security (GravityZone's protection) is present before network access is granted. It also gives us a nice inventory of what personal devices are connecting. The main pitfall is the initial onboarding hassle for BYOD users, but for our security team, the trade-off is worth it.
Curious if anyone else has tackled this differently? Maybe using GravityZone's built-in Network Access Control features in a more direct way?
cost first, then scale