Identifying corporate machines on a VPN

[Buzzark]

I am fairly new to Fortigates having previously mostly used Cisco ASA/Sonicwall/Checkpoint, I like what I've seen so far but am struggling to find ways of authenticating or identifying a machine on a VPN.

I'm expecting to use the client and full tunnel, ideally over SSL.

What I cannot find in the manuals or cookbooks is the ability to authenticate a connecting machine as well as a user.  e.g. if I did this on a Cisco ASA I would have the choice or combination of several methods;

Machine certificate deployed through AD, a registry key, a file name or text file content, verified domain membership, verified AD computer group membership, certain software, firewall or AV version in place and iirc, some others.

I haven't worked in a company yet that allows (or wanted) non-corporate machines to connect to the corporate VPN so this is a fairly common requirement.

Can somebody point me to the right documentation?

Thanks.

[ede_pfau]

In FortiClient, you can check the connecting machine's registry for a unique key. For this, get the FortiClientTools and with that create a custom XML config file.

In the registry, you'll find the serial somewhere. But to check that against a list on the FGT side isn't easy. It would be easier to check domain membership.

[Buzzark]

Thanks, good to hear there are some options.  I'll have a look at the FortiClient manual then, see what's available.