This message was deleted.

Why not stick auth in front of it and tie it to a group? Just basic auth will be supported.

User-Agent check but it‘s easy to fake.

Using machine certificate for authentication could work.

And how to deploy certificates to non-managed devices?

Hence the user auth, deploying certs to unmanaged devices is a pain.

Yep it's not really practical to do it even if technically possible.

Thanks to all. Same ideas like mine but nothing’s ideal 😄 I think I have to work with classic aaa preauth.