unauthenticated users

Reply
Highlighted
L3 Networker

unauthenticated users

Is there a simple way to prevent unauthenticated users from accessing the internet from the inside?

It is my understanding that you cannot negate AD Groups? True?

I was hoping to create a policy like this that would deny any unauthenticated users from accessing the internet.

Zone                    Address          User                                   Zone     Address        Action    

LAN                     Any               domain/domain users            WAN     Any             Allow   

                                                     NEGATE

Not applicable

Re: unauthenticated users

The simplest being deny all access to 'unknown-user' in the "source user" field. That way only authenticated users will be able to gain access to whatever rules you permit whereas any unauthenticated traffic will be dropped.

Does that help?

L6 Presenter

Re: unauthenticated users

If you setup a security policy like:

Zone: LAN

Address: Any

User: domain/domain users

Zone: WAN

Address: Any

Action: Allow

followed with a (the built in default deny rule doesnt log):

Zone: Any

Address: Any

User: Any

Zone: Any

Address: Any

Action: Deny

Options: Log on session end

Then only clients from your LAN zone which are authenticated against the AD and belongs to the domain users group will be allowed to pass through.

L3 Networker

Re: unauthenticated users

I have no such user called unknown-user in the user tab of the Security Policy Rule.

Not applicable

Re: unauthenticated users

Bill, I'm sorry. It's just "unknown" in the source user option:

unknown-user.png

Any traffic the PA is unable to correlate user <-> ip, using whichever authentication methods, is treated as "unknown" in the user field.

You can use the "unknown" user as an object for a Deny rule.

Hope it helps.

L3 Networker

Re: unauthenticated users

Thanks Filipe, that's what I was looking for.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!