Device posture check without F5 Access guard

Question

Can I implement device posture check on APM for remote VPN users without having to deploy an additional software like F5 access guard? I am wondering if the edgeclient software can collect the endpoint info and pass it over to the APM for the initial auth req? I am not looking to check posture in realtime or per-req.

Thank you.

james_jinwon_lee · Answer

shashe&nbsp;APM also can collect limited device information from HTTP headers without additional S/W installation.&nbsp; However, if you need to collect detailed device information from the client, SW installation is required.&nbsp;

shashe · Answer

I tested this with Fatclient but without Access Guard app. It works well with just fat client. In short: the fat client is enough to make these endpoint checks.

leslie_hubertus · Answer

Hi&nbsp;shashe&nbsp;- some solid questions. I got rid of the spammer who replied to your post. I think&nbsp;James_Jinwon_Lee&nbsp;could answer your questions if nobody else chimes in.&nbsp;

shashe · Answer

James_Jinwon_Lee&nbsp;Thanks for your response. can you please detail the information it collects? What device posture checks can I enforce without the need for additional s/w clients. We have a combination of MAC,windows, android and iphones.&nbsp;&nbsp;Thanks.

james_jinwon_lee · Answer

shashe&nbsp;F5 APM supports two types of endpoint posture checks as a policy in the VPE(Visual Policy Editor), 'Client-Side' and 'Server-Side'. For the 'Client-Side' check, we need to install 'Endpoint Inspection' S/W to check the specific information from the client machine. So, in this method, APM can do detail checking such as file existence, AV status, Windows registry and etc. However, for the 'Server-Side' check, we use the header and other network telemetry data we can collect from the request. Thus, the information we can check in this method is quite limited, such as IP geolocation, IP reputation, client OS, browser type and etc.&nbsp;