unauthenticated users

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

unauthenticated users

L3 Networker

Is there a simple way to prevent unauthenticated users from accessing the internet from the inside?

It is my understanding that you cannot negate AD Groups? True?

I was hoping to create a policy like this that would deny any unauthenticated users from accessing the internet.

Zone                    Address          User                                   Zone     Address        Action    

LAN                     Any               domain/domain users            WAN     Any             Allow   

                                                     NEGATE

1 accepted solution

Accepted Solutions

Bill, I'm sorry. It's just "unknown" in the source user option:

unknown-user.png

Any traffic the PA is unable to correlate user <-> ip, using whichever authentication methods, is treated as "unknown" in the user field.

You can use the "unknown" user as an object for a Deny rule.

Hope it helps.

View solution in original post

5 REPLIES 5

Not applicable

The simplest being deny all access to 'unknown-user' in the "source user" field. That way only authenticated users will be able to gain access to whatever rules you permit whereas any unauthenticated traffic will be dropped.

Does that help?

L6 Presenter

If you setup a security policy like:

Zone: LAN

Address: Any

User: domain/domain users

Zone: WAN

Address: Any

Action: Allow

followed with a (the built in default deny rule doesnt log):

Zone: Any

Address: Any

User: Any

Zone: Any

Address: Any

Action: Deny

Options: Log on session end

Then only clients from your LAN zone which are authenticated against the AD and belongs to the domain users group will be allowed to pass through.

I have no such user called unknown-user in the user tab of the Security Policy Rule.

Bill, I'm sorry. It's just "unknown" in the source user option:

unknown-user.png

Any traffic the PA is unable to correlate user <-> ip, using whichever authentication methods, is treated as "unknown" in the user field.

You can use the "unknown" user as an object for a Deny rule.

Hope it helps.

Thanks Filipe, that's what I was looking for.

  • 1 accepted solution
  • 4763 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!