Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 265 / 861

264 Limiting user access
Authenticating using Out-Of-Band Authentication (OOBA)
5
To have the security gateway receive the group information from a server, check Group
Information.
If you leave Group Information unchecked, group information is not passed to the security gateway
and all users on the server are authenticated.
6
Optionally, on the Description tab, type a more detailed description than you typed in the caption
text box.
7 Click OK .
8 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
To add dynamic authentication to an existing rule
1 In the SGMI, in the left pane, under Assets, click Firewall .
2 In the right pane, on the Rules tab, select the rule to which that you want to add dynamic
authentication, and then click
Properties .
3
In the Rule Properties dialog box, on the Authentication tab, in the Authentication scheme drop-
down list, select the dynamic authentication scheme.
4 Below the Included user groups text box, click Add .
5 In the Select User Groups dialog box, in the User Group list box, select the groups whose users you
want to authenticate. You can select multiple groups.
If you select the dynamic-none group, authentication is extended to all users on the external
authentication servers in the dynamic authentication scheme who are not in any group.
6 Click OK .
7 In the Rule Properties dialog box, click OK .
8 Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Authenticating using Out-Of-Band Authentication (OOBA)
Out-of-Band Authentication (OOBA) is a one-size-fits-all authentication for any proxy with an
unsupported authentication path. Essentially, OOBA is any authentication you can configure that is
outside of normal in-band communications for the proxy in question. For example, authentication is
supported on HTTP, but under limited circumstances. Using OOBA, users can authenticate through a
challenge-response prompt that is not normally supported with HTTP. Other proxies, such as H.323,
which have never supported authentication, can authenticate using OOBA.