Restricting users to Internet only

[MemphisBrothers]

How can I restrict a certain group (ip range\VLAN) to internet only access.?  I don't want them to get to internal network shares with unfamiliar devices. We use Aruba Clear pass to authenticate and assign IPs and the PA 500 sits on the parameter. I know the answer is not the PA but probably a mixture of my other network devices.

Clearpass Device manager and Juniper 4200 switches with cisco switches in IDF

[HULK]

Hello,

While those groups (IP range\VLAN) are accessing internal resources, is the same traffic passing through the PAN firewall....?

If so, then you can create a policy to block internal resources base on user-group or source IP subnet.

Thanks

[pulukas]

If the layer 3 traffic is occurring on the Juniper or Cisco switches, you would need to implement the restrictions at that point of the traffic path.  As Hulk notes, if the traffic reaches the Palo Alto before the destination then a rule here can restrict the access.  But it sounds like you have internal layer 3 connections that are permitted without reaching the Palo Alto.

both Cisco and Juniper switches perform this function via packet based (not session based) filters.  You create the allow filter and apply this to the layer 3 interface on the switch.

On the Juniper switches you would use the feature firewall filters applied to the RVI (Routed Vlan interface) on the switch.

Juniper Documentation

Firewall Filters Configuration Guide - Technical Documentation - Support - Juniper Networks

Free Day One book on the feature:

http://www.juniper.net/us/en/community/junos/training-certification/day-one/fundamentals-series/conf...

On the Cisco switches the feature is ACL (access control lists)

Cisco Documentation

Configuring IP Access Lists - Cisco Systems