Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual, Page: 251 / 861

250 Limiting user access
Configuring user groups for internal and external authentication
■
“Using roles to assign rules to users” on page 424
■
“Using the Remote Access Tunnel Wizard to create Client VPN tunnels” on page 389
■
“Manually configuring a Client VPN tunnel” on page 394
Creating an IKE user group
To use a user group as the remote endpoint of a Client VPN tunnel, the user group must be IKE-enabled.
Prerequisites
Complete the following task before beginning this procedure:
■
“Configuring user groups for internal and external authentication” on page 247
To create an IKE user group
1 In the SGMI, in the left pane, under Assets, click Users .
2 In the right pane, on the User Groups tab, select the group you want to use in a VPN tunnel, and
then click
Properties .
3 In the User Group Properties dialog box, on the VPN Authentication tab, do the following:
4 On the VPN Network Parameters tab, under Domain Name System (DNS), do the following:
5 Under Windows Internet Naming Service (WINS), do the following:
6 To open tunnels automatically when the client reboots, in the Tunnels to automatically open text
box, type the number of tunnels to open.
User Distinguished Name (DN)
includes Type the Distinguished Name (DN) of the user group. This is used for
authenticating VPN clients with X.509 certificates.
Issuer Distinguished Name (DN)
includes Type the Distinguished Name (DN) of the LDAP server. This is used for
authenticating VPN clients with X.509 certificates.
Authentication Method Select the authentication scheme you want to apply to the traffic in the
tunnel.
User binding Select the type of binding, if any, to use.
Enforce client compliance Select whether to require the remote client to be compliant with security
gateway requirements.
Enforce group binding To enforce group binding, check Enforce group binding .
Primary Server Type the IP address or fully-qualified domain name of the primary DNS
server.
Secondary Server Type the IP address or fully-qualified domain name of the secondary DNS
server, if any.
Primary Server Type the IP address or fully qualified domain name of the primary WINS
server.
Secondary Server Type the IP address or fully qualified domain name of the secondary WINS
server, if any.