Juniper NETWORK AND SECURITY MANAGER, Руководство пользователя

Страница: 304 / 340

To configure a session-export policy:
1.
In the NSM navigation tree, select Device Manager > Devices . Click the Device Tree
tab, and then double-click the Secure Access device for which you want to configure
a session-export policy.
2.
Click the Configuration tab. In the configuration tree, select System > IF–MAP
Federation > Session-Export Policies .
3.
Add or modify settings as specified in Table 84 on page 286.
4.
Click one:
• OK —Saves the changes.
•
Cancel —Cancels the modifications.
You must create corresponding session-import policies that allow IF-MAP client Infranet
Controllers that are connected to an Infranet Enforcer in front of protected resources to
collect IF-MAP data from the IF-MAP server.
Table 84: IF–MAP Session-Export Policy Configuration Details
Your Action Function Option
Enter a name for the policy. Specifies a unique name for
the policy. Name
Enter a brief description for the policy. Describes the policy. Description
Type the administrative domain for the session
export policy. If you want different aspects of a
user session to be exported with different
administrative domains, you then create several
export rules. Identifies the IP address,
username, or MAC address
data.
In a large network
environment with several
domains, a username, an IP
address, or a MAC address
could be duplicated. By
entering the domain, you
ensure that the correct user
is identified.
Administrative
Domain
Select roles from the Non-members area and add
the roles to the Members area. Determines the roles for
which this policy should
apply. Roles
Select this option to stop matching roles after a
successful match is found. Stops matching the roles
when an IF-MAP client has
successfully matched the
roles selected for this policy
to roles based on
session-import policies
configured on the target
device. Stop on match
Identity tab
Copyright © 2010, Juniper Networks, Inc. 286
Configuring Secure Access Devices Guide