Juniper NETWORK AND SECURITY MANAGER 2010.3, Administration Manual

Page: 456 / 1016

Group Expressions
If the security policy defines authentication for user objects that match the
description of group expression “a” AND group expression “b,” the security device
authenticates the user only if both group expressions reference that user. AND
If the security policy defines authentication for user objects that do not match
the description of group expression “c” (NOT “c” ), the security device
authenticates all users except those that match the group expression. NOT
Because a group expression references external user objects and external user groups,
you must first create those user object and groups before you can use them in a group
expression. You cannot reference local user object or local user object groups in a group
expression.
To add a group expression:
1.
In the navigation tree, double-click Object Manager and select Group Expressions .
2.
In the main display area, click the Add icon and select New . The New Group Expression
dialog box appears.
3.
Enter a name, color, and comment for the group expression.
4.
Select the operator you want to use in the expression (OR, AND, NOT) and then
configure the operands:
•
For NOT expressions, use Operand 1 to select the user object, group, or expression
that cannot be present for a successful match. Because the operation is exclusion,
you do not need to configure Operand 2.
• For AND expressions, use Operand 1 and Operand 2 to select the two user objects,
groups, or expressions that must be present for a successful match.
•
For OR expressions, use Operand 1 and Operand 2 to select the two user objects,
groups, or expressions, one of which must be present for a successful match.
5.
Click OK . The group expression object appears in the Object Manager.
After you have created a group expression object, you can use that object in the
Authentication rule options.
In this example, you configure a group expression to authenticate all users that belong
to your Sales group and your Marketing group, then add the expression to a security policy
that provides access to your protected networks.
1.
First, create two external user group objects: one to represent the Sales users and
the other to represent the Marketing users.
Copyright © 2010, Juniper Networks, Inc. 406
Network and Security Manager Administration Guide