Watchguard SSL 1000, User Manual

Page: 179 / 198

Administration Guide 169
Scenario 2: Creating Guest Accounts Using the Local Users List
5
In the left pane, click the "Email server" network resource you just created and drag it to
Application Network Policies listed under Application Constraints in the right pane. Click
OK .
6 In the left pane, expand both the "Remote Sales" user group and the "Remote Engineers" user
group.
7 In the right pane, under Application Policies , click the "Email Application Policy" and drag it to
Application Policies under the Remote Sales user group in the left pane, so that the
Application Policy is part of the Remote Sales ACL.
8 In the right pane, under Application Policies , click the "Email Application Policy" and drag it to
Application Policies under the Remote Engineers user group in the left pane, so that the
Application Policy is part of the Remote Engineers ACL.
Note
In the procedure above, the administrator could also add an application end point policy to the
application policy to require every client device to meet specific requirements when accessing the email
server. For more information, see “Application policies” on page 101.
This procedure concludes the scenario for configuring LDAP authentication and authorization.
When this procedure is complete, the administrator has configured all of the following:
• Users can authenticate to the LDAP directory specified in the Default authentication realm
using their LDAP directory credentials.
• Users are authorized to access the internal network resources based on their group
memberships in the LDAP directory and on the Firebox SSL VPN Gateway.
Only users who are members of the "Remote Sales" group and the "Remote Engineers" group are
authorized to access resources on the internal network. (Each of these groups must exist both in the
LDAP directory and on the Firebox SSL VPN Gateway.)
• Users in the "Remote Sales" group are authorized to access the Web conference server and file
servers in the 10.10.0.0/24 network and the Sales Web application in the 10.60.10.0/24
network.
The Sales users can access the email application on the server with the 10.10.25.50 IP address, but
cannot access the email application on other email servers in the allowed networks.
The Sales users can also access other network resources located in the two allowed networks.
• Users in the "Remote Engineering" group can access the Web conference server and the file
servers in the 10.10.0.0/24 network (and other network resources located in this network).
The Engineering users can also access the email application on the server with the 10.10.25.50 IP
address, but cannot access the email application on other email servers in the allowed networks.
To understand the purpose of local users on the Firebox SSL VPN Gateway and to understand how
to enable authentication and authorization for the local users, continue to “Scenario 2: Creating
Guest Accounts Using the Local Users List” on page 169.
Scenario 2: Creating Guest Accounts Using the Local Users List
This example illustrates how local users work on the Firebox SSL VPN Gateway and shows one way in
which an administrator can support authentication and authorization for the local users.
In the previous example, users were authenticated and authorized based on their LDAP directory cre-
dentials and group memberships.