Use Authorized Users and Groups in Policies
You can use specified user and group names when you create policies in Policy Manager. For example, you can define all policies to only allow connections for authenticated users. Or, you can limit connections on a policy to particular users.
The term authorized users and groups refers to users and groups that are allowed to access network resources.
Define Users and Groups for Firebox Authentication
If you use your Firebox or XTM device as an authentication server and want to define users and groups that authenticate to the Firebox or XTM device, see Define a New User for Firebox Authentication and Define a New Group for Firebox Authentication.
Define Users and Groups for Third-Party Authentication
You can use Policy Manager to define the users and groups to use for third-party authentication.
- Create a group on your third-party authentication server that contains all the user accounts on your system.
- Select Setup > Authentication > Authorized Users/Groups.
The Authorized Users and Groups dialog box appears.
- Click Add.
The Define New Authorized User or Group dialog box appears.
- Type a user or group name you created on the authentication server.
- (Optional) Type a description for the user or group.
- Select Group or User.
- From the Auth Server drop-down list, select your authentication server type.
Select RADIUS for authentication through a RADIUS or VACMAN Middleware server, or Any for authentication through any other server.
- Click OK.
Add Users and Groups to Policy Definitions
Any user or group that you want to use in your policy definitions must be added as an authorized user. All users and groups you create for Firebox authentication and all Mobile VPN users are automatically added to the list of authorized users and groups on the Authorized Users and Groups dialog box. You can add any users or groups from third-party authentication servers to the authorized user and group list with the previous procedure. You are then ready to add users and groups to your policy configuration.
- From Policy Manager,select the Firewall tab.
- Double-click a policy.
The Edit Policy Properties dialog box appears.
- On the Policy tab, below the From box, click Add.
The Add Address dialog box appears.
- Click Add User.
The Add Authorized Users or Groups dialog box appears.
- From the left Type drop-down list, select whether the user or group is authorized as a Firewall, PPTP, or SSL VPN user.
For more information on these authentication types, see Types of Firebox Authentication.
- From the right Type drop-down list, select either User or Group.
- If your user or group appears in the Groups list, select the user or group and click Select.
The
Add Address dialog box reappears with the user or group in the Selected Members or Addresses box.
Click OK to close the Edit Policy Properties dialog box.
- If your user or group does not appear in the list in the Add Authorized Users or Groups dialog box, see Define a New User for Firebox Authentication, Define a New Group for Firebox Authentication, or the previous Define users and groups for third-party authentication procedure.
After you add a user or group to a policy configuration, WatchGuard System Manager automatically adds a WatchGuard Authentication policy to your Firebox or XTM device configuration. Use this policy to control access to the authentication portal web page.
For instructions to edit this policy, see Use Authentication to Restrict Incoming Traffic.
See Also
About Using Third-Party Authentication Servers
Set Access Rules for a Policy
