07-13-2021 03:18 PM
We just started looking into authentication policy and while testing it works for web services but what about any other services rdp/ssh/or anything else. The BPA document says we should set authentication policy to Any, but doing that SSH in our test gets blocked, with a auth-policy-deny, and there are no redirects for SSH.
Also if the user information is already known to firewall form other sources such as user agent, is the firewall still supposed to redirect and ask for authentication.
07-13-2021 05:53 PM - edited 07-13-2021 05:54 PM
The authentication policy really can't be used for things like RDP or SSH if you want to serve the authentication prompt properly because you can't redirect users, as you've experienced. In regards to your second question, that really depends on how you've configured the authentication policy. Since authentication policy can be used as an additional authentication check against users, if you want it to not apply to known users you would simply target unknown as your source-user so it doesn't match on know users.
07-14-2021 07:13 AM
@BPry Thanks, I had forgotten about the unknown user option. Why does the BPA say to set service to any as it will only work for HTTP/HTTPS. I understand we want to cover all the ports for web but setting it to any in authentication policy effects other applications, such as ssh in our example test.
"Captive Portal identifies user information for web traffic (HTTP or HTTPS) that matches an Authentication policy rule so you can identify users whose information isn’t available to the firewall.
Setting service as 'any' in Authentication rules for captive portal functionality ensures web traffic on all ports can be monitored to learn user information. Hence not just HTTP and HTTPS but all ports need to be enabled as web traffic can originate on non standard ports too."
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!