- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-28-2013 09:42 AM
Is there a simple way to prevent unauthenticated users from accessing the internet from the inside?
It is my understanding that you cannot negate AD Groups? True?
I was hoping to create a policy like this that would deny any unauthenticated users from accessing the internet.
Zone Address User Zone Address Action
LAN Any domain/domain users WAN Any Allow
NEGATE
01-28-2013 12:25 PM
Bill, I'm sorry. It's just "unknown" in the source user option:
Any traffic the PA is unable to correlate user <-> ip, using whichever authentication methods, is treated as "unknown" in the user field.
You can use the "unknown" user as an object for a Deny rule.
Hope it helps.
01-28-2013 10:31 AM
The simplest being deny all access to 'unknown-user' in the "source user" field. That way only authenticated users will be able to gain access to whatever rules you permit whereas any unauthenticated traffic will be dropped.
Does that help?
01-28-2013 10:35 AM
If you setup a security policy like:
Zone: LAN
Address: Any
User: domain/domain users
Zone: WAN
Address: Any
Action: Allow
followed with a (the built in default deny rule doesnt log):
Zone: Any
Address: Any
User: Any
Zone: Any
Address: Any
Action: Deny
Options: Log on session end
Then only clients from your LAN zone which are authenticated against the AD and belongs to the domain users group will be allowed to pass through.
01-28-2013 12:18 PM
I have no such user called unknown-user in the user tab of the Security Policy Rule.
01-28-2013 12:25 PM
Bill, I'm sorry. It's just "unknown" in the source user option:
Any traffic the PA is unable to correlate user <-> ip, using whichever authentication methods, is treated as "unknown" in the user field.
You can use the "unknown" user as an object for a Deny rule.
Hope it helps.
02-07-2013 11:56 AM
Thanks Filipe, that's what I was looking for.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!