Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 416 / 861

415 Enabling remote access with clientless VPN
Using rules to allow or deny clientless VPN access
Related information
For further information related to this topic, see the following:
■
“VPN Profile Properties—General tab” on page 618
■
“Creating and assigning roles” on page 426
■
“Using portal pages to customize the user experience” on page 432
Using rules to allow or deny clientless VPN access
Clientless VPN rules determine whether the remote users are allowed or denied access to internal
network resources. Rules contain a series of expression statements that is matched to all resource
requests made by the user.
You can create rules as exact match expressions, meaning if the URL the user attempts to access does
not exactly match the profile, the user is not granted access. You can also enter rules as regular
expressions. This lets you grant or deny access to a wide range of resources using one access rule.
Clientless VPN roles let you easily assign access privileges to users from a hierarchical (parent/child)
system of inheritance; the child role inherits the access privileges of all its parent roles. Access
privileges depend on the rules or rule sets that are bound to a particular role.
A rule defines URLs that identify internal network resources. Each rule is identified by a unique name.
There are two types of clientless VPN rules:
Rule components
A rule specifies the minimum requirements needed in the URL to identify a resource. The most
significant URL components of an access rule are:
About simple rules
Simple rules let you quickly define access permission and create elementary matching patterns for the
most essential URL components. A simple rule identifies specific resources and the attributes required
for access. To use more sophisticated pattern matching, use the advanced rules.
See “About advanced rules” on page 419.
Simple rules Identifies resources that have straightforward attributes (such as an email server), or if you
are uncomfortable using regular expressions.
Advanced rules Identifies a resource and the attributes required to access it. The attributes vary by resource
protocol and are entered as regular expressions. An advanced rule can identify one or more
resource protocols that are located on the same host.
Access type Determines whether the rule allows or denies access to the resource.
Resource protocol Defines the type of traffic controlled by the rule, including File, Mail (email), MAPI,
Microsoft Outlook, HTTP (Web), HTTPS (secure Web), FTP, TELNET, TCP, UDP, and VPN.
Host name A pattern matching the domain name or IP of the computer/server where the resource is
located.