Watchguard Firebox SSL Series, User Manual

Page: 178 / 198

Scenario 1: Configuring LDAP Authentication and Authorization
168 Firebox SSL VPN Gateway
the 10.0.20.x resource and allow access to the 10.0.x.x resource.
In these cases, configure the policy denying access to 10.0.20.x first and then configure the policy
allowing access to the 10.0.x.x network second. Always configure the most restrictive policy first and the
least restrictive policy last.
Creating an Application Policy for an Email Server
Creating an application policy for an email server is the last of five procedures the administrator
performs to configure access to the internal network resources in the configuring LDAP
authentication and authorization scenario.
In this example, the network 10.10.0.0/24 contains three email servers, but the administrator wants
the remote Sales and Engineering users to have access to only one of these email servers. The email
server that remote users must access has the IP address 10.10.25.50/32.
To enable users to access only a single email server, the administrator creates an application policy
on the Firebox SSL VPN Gateway that enables the users to access only the email application on the
10.10.25.50/32 email server.
Note
An administrator uses application policies to require a client application to access a specific internal
server or to require a client device to meet specific requirements before it is allowed to access an
internal server.
To create an application policy to restrict email client access to one server, the administrator must
perform three actions:
• Create a network resource that includes only the email server
• Create an application policy that specifies the email application on the email server and
assign the network resource containing the email server to this application policy
• Assign the application policy to the user groups in the Firebox SSL VPN Gateway
In this example, the administrator creates a network resource named "Email Server" that includes
only IP address 10.10.25.50/32 (the email server). The administrator then creates an application
policy named "Email Application Policy" that specifies the email application that remote users can
access. The administrator assigns the "Email Server" network resource to this application policy.
Next, the administrator adds the "Email Application Policy" to the Remote Sales and Remote
Engineers groups. Adding the policy to those groups ensures that those groups always access the
email application on the specific email server specified by the administrator in the application
policy.
To implement the application policy for the email server
1 From the right pane of the Access Policy Manager tab in the Firebox SSL VPN Gateway
Administration Tool, create a new network resource named "Email server." For this Network
Resource, specify only the IP address of the email server that users are allowed to access (for
example, 10.10.25.50/ 32). This is the same basic procedure that was used to define the network
resources for the Sales users and Engineering users in the previous procedures.
2 In the right pane, right-click Application Policies and then click New Application Policies .
3 In Application Resource Name , type "Email Application Policy" and click OK .
4 Browse to and select the email application located on the server that has the IP address
10.10.25.50/32.
The MD5 field is populated automatically with the binary sum of the application.