WatchGuard Technologies SSL VPN manual 10.10.0.0/24 10.60.10.0/24

Scenario 1: Configuring LDAP Authentication and Authorization

4In Network/Subnet, type these two IP address/subnet pairs for the resources. Separate each of these IP address/subnet pairs with a space:

10.10.0.0/24 10.60.10.0/24

5To simplify this example, the administrator accepts the default values for the other settings on the Network Resource window and clicks OK.

After creating the Network Resource named "Sales Resource," the administrator uses the procedure below to add this network resource to the ACL of the "Remote Sales" user group.

1From the Firebox SSL VPN Gateway Administration Tool, click the Access Policy Manager tab.

2In the left-pane, expand User Groups, and then expand the "Remote Sales" user group.

3In the right pane, expand Network Resources.

4Click the "Sales Resource" network resource and drag it to Network Policies beneath the "Remote Sales" user group in the left-hand pane.

With this action, the administrator grants the users associated with the "Remote Sales" user group access to the systems defined in the network resource named "Sales Resources."

Note

In the procedure above, the administrator assigned the "Sales Resource" network resource to the access control list (ACL) of the "Remote Sales" user group. The administrator creates ACLs on the Firebox SSL VPN Gateway by adding resources to the network policies, application policies, kiosk policies, and end point policies associated with the user group. The ACL is comprised of all policies that are assigned to a user group on the Firebox SSL VPN Gateway.

Creating and Assigning Network Resources to the Engineering users

This section briefly discusses how the administrator creates a network resource and assigns it to the Engineering users. This procedure is essentially the same as the procedure completed for the Sales users in the previous step, except the administrator does not provide the engineering users with access to the Sales Web application in the 10.60.10.0/24 network.

As noted earlier, the Engineering users need access to a Web conference server, an email server, and several file servers. All of these servers reside in the network 10.10.0.0/24.

To provide the Engineering users with access to the network:

1From the right pane of the Access Policy Manager tab in the Firebox SSL VPN Gateway Administration Tool, create a new network resource named "Engineering Resources." Specify only the 10.10.0.0/24 network when creating this resource.

2In the left pane, expand the "Remote Engineers" user group.

3Drag the "Engineering Resources" network resource from the right pane of the Access Policy Manager tab to the Network Policies of the "Remote Engineers" group in the left pane.

The "Engineering Resources" Network Resource is now part of the ACL for the "Remote Engineers" group.

Note

In more complex environments, it may be necessary to restrict access to a particular segment of a larger network. For example, an administrator may need to deny access to the 10.0.20.x network while allowing access to everything else in the 10.0.x.x network. The administrator creates a network resource for the 10.0.20.x network and a network resource for the 10.0.x.x network and assigns both network resources to the user group. The administrator then right-clicks each of the resources to deny access to

Administration Guide 167