WatchGuard Technologies SSL VPN manual 10.10.25.50/32

Scenario 1: Configuring LDAP Authentication and Authorization

the 10.0.20.x resource and allow access to the 10.0.x.x resource.

In these cases, configure the policy denying access to 10.0.20.x first and then configure the policy allowing access to the 10.0.x.x network second. Always configure the most restrictive policy first and the least restrictive policy last.

Creating an Application Policy for an Email Server

Creating an application policy for an email server is the last of five procedures the administrator performs to configure access to the internal network resources in the configuring LDAP authentication and authorization scenario.

In this example, the network 10.10.0.0/24 contains three email servers, but the administrator wants the remote Sales and Engineering users to have access to only one of these email servers. The email server that remote users must access has the IP address 10.10.25.50/32.

To enable users to access only a single email server, the administrator creates an application policy on the Firebox SSL VPN Gateway that enables the users to access only the email application on the 10.10.25.50/32 email server.

Note

An administrator uses application policies to require a client application to access a specific internal server or to require a client device to meet specific requirements before it is allowed to access an internal server.

To create an application policy to restrict email client access to one server, the administrator must perform three actions:

•Create a network resource that includes only the email server

•Create an application policy that specifies the email application on the email server and assign the network resource containing the email server to this application policy

•Assign the application policy to the user groups in the Firebox SSL VPN Gateway

In this example, the administrator creates a network resource named "Email Server" that includes only IP address 10.10.25.50/32 (the email server). The administrator then creates an application policy named "Email Application Policy" that specifies the email application that remote users can access. The administrator assigns the "Email Server" network resource to this application policy. Next, the administrator adds the "Email Application Policy" to the Remote Sales and Remote Engineers groups. Adding the policy to those groups ensures that those groups always access the email application on the specific email server specified by the administrator in the application policy.

To implement the application policy for the email server

1From the right pane of the Access Policy Manager tab in the Firebox SSL VPN Gateway Administration Tool, create a new network resource named "Email server." For this Network Resource, specify only the IP address of the email server that users are allowed to access (for example, 10.10.25.50/ 32). This is the same basic procedure that was used to define the network resources for the Sales users and Engineering users in the previous procedures.

2In the right pane, right-click Application Policies and then click New Application Policies.

3In Application Resource Name, type "Email Application Policy" and click OK.

4Browse to and select the email application located on the server that has the IP address

10.10.25.50/32.

The MD5 field is populated automatically with the binary sum of the application.

168 Firebox SSL VPN Gateway