UTT Technologies
Chapter 8 User Management
http://www.uttglobal.com
Page
10310310
7.2.3 Execution Order of Group Management Policies
If a user’s computer belongs to more than one group, in other words, if the user matches
more than one group management policy, it will be subject to the first one added. More
specifically, after you configure some group management policies, the Gigabit Router will
search the
Group Management List
to find out if there is a policy matching a user. It will
check the user’s IP address against each policy in the order in which the policies are listed.
The first matching policy will apply to the user. Note that the policies are listed in
chronological order of creation (i.e., most recent at the bottom).
7.2.4 Priorities of Global and Group Management
Policies and Access Rules
The access rules have higher priority than the group management policies, and the group
management policies have higher priority than the global management policy. That is,
when receiving a packet initiated from a local computer, the Gigabit Router will first check
it against the access rules, next the group management policies, lastly the global
management policy. The first rule (or policy) that matches the packet is applied. After a
match is found, no further rules or policies are checked.
For example, if you have selected the
Block MSN
check box in the
User > Global
Management
page, added a group management policy which allows a group of users to
use MSN (
Block MSN
check box is cleared) in the
User > Group Management
page,
and added an access rule which denies all users access to the Internet in the
Firewall >
Access Control
page, then any users are unable to access the Internet because the
access rule is matched first. Now if you only delete the access rule, then the users belong
to the specified group can use MSN, but other users cannot.
7.2.5 An Example for Group Management Policy
1. Requirements
A business uses a HiPER 840G Gigabit Router to access the Internet. The CEO wants to
control Internet behaviors of the employees of the Administration Department and
Business Department:
1) Block the Administration Department’s employees (IP range: 192.168.1.2-
192.168.1.10) from using MSN and QQ, and allow them to access all other services.
