Administration Guide
167
Scenario 1: Configuring LDAP Authentication and Authorization
4
In
Network/Subnet
, type these two IP address/subnet pairs for the resources. Separate each of
these IP address/subnet pairs with a space:
10.10.0.0/24 10.60.10.0/24
5
To simplify this example, the administrator accepts the default values for the other settings on
the
Network Resource
window and clicks
OK
.
After creating the Network Resource named "Sales Resource," the administrator uses the procedure
below to add this network resource to the ACL of the "Remote Sales" user group.
1
From the Firebox SSL VPN Gateway Administration Tool, click the
Access Policy Manager
tab.
2
In the left-pane, expand
User Groups
, and then expand the "Remote Sales" user group.
3
In the right pane, expand
Network Resources
.
4
Click the "Sales Resource" network resource and drag it to
Network Policies
beneath the
"Remote Sales" user group in the left-hand pane.
With this action, the administrator grants the users associated with the "Remote Sales" user group
access to the systems defined in the network resource named "Sales Resources."
Note
In the procedure above, the administrator assigned the "Sales Resource" network resource to the access
control list (ACL) of the "Remote Sales" user group. The administrator creates ACLs on the Firebox SSL
VPN Gateway by adding resources to the network policies, application policies, kiosk policies, and end
point policies associated with the user group. The ACL is comprised of all policies that are assigned to a
user group on the Firebox SSL VPN Gateway.
Creating and Assigning Network Resources to the Engineering users
This section briefly discusses how the administrator creates a network resource and assigns it to the
Engineering users. This procedure is essentially the same as the procedure completed for the Sales
users in the previous step, except the administrator does not provide the engineering users with
access to the Sales Web application in the 10.60.10.0/24 network.
As noted earlier, the Engineering users need access to a Web conference server, an email server, and
several file servers. All of these servers reside in the network 10.10.0.0/24.
To provide the Engineering users with access to the network:
1
From the right pane of the
Access Policy Manager
tab in the Firebox SSL VPN Gateway
Administration Tool, create a new network resource named "Engineering Resources." Specify
only the 10.10.0.0/24 network when creating this resource.
2
In the left pane, expand the "Remote Engineers" user group.
3
Drag the "Engineering Resources" network resource from the right pane of the
Access Policy
Manager
tab to the
Network Policies
of the "Remote Engineers" group in the left pane.
The "Engineering Resources" Network Resource is now part of the ACL for the "Remote Engineers"
group.
Note
In more complex environments, it may be necessary to restrict access to a particular segment of a larger
network. For example, an administrator may need to deny access to the 10.0.20.x network while
allowing access to everything else in the 10.0.x.x network. The administrator creates a network resource
for the 10.0.20.x network and a network resource for the 10.0.x.x network and assigns both network
resources to the user group. The administrator then right-clicks each of the resources to deny access to
Summary of Contents for Firebox SSL Series
Page 1: ...WatchGuard Firebox SSL VPN Gateway Administration Guide Firebox SSL VPN Gateway ...
Page 40: ...Using the Firebox SSL VPN Gateway 30 Firebox SSL VPN Gateway ...
Page 118: ...Setting the Priority of Groups 108 Firebox SSL VPN Gateway ...
Page 146: ...Managing Client Connections 136 Firebox SSL VPN Gateway ...
Page 168: ...Generating Trusted Certificates for Multiple Levels 158 Firebox SSL VPN Gateway ...
Page 190: ...180 Firebox SSL VPN Gateway ...
Page 198: ...188 Firebox SSL VPN Gateway ...
