Watchguard SSL 1000 User Manual page 177

4 In Network/Subnet, type these two IP address/subnet pairs for the resources. Separate each of
these IP address/subnet pairs with a space:
10.10.0.0/24 10.60.10.0/24
5 To simplify this example, the administrator accepts the default values for the other settings on
the Network Resource window and clicks OK.
After creating the Network Resource named "Sales Resource," the administrator uses the procedure
below to add this network resource to the ACL of the "Remote Sales" user group.
1 From the Firebox SSL VPN Gateway Administration Tool, click the Access Policy Manager tab.
2 In the left-pane, expand User Groups, and then expand the "Remote Sales" user group.
3 In the right pane, expand Network Resources.
4 Click the "Sales Resource" network resource and drag it to Network Policies beneath the
"Remote Sales" user group in the left-hand pane.
With this action, the administrator grants the users associated with the "Remote Sales" user group
access to the systems defined in the network resource named "Sales Resources."
In the procedure above, the administrator assigned the "Sales Resource" network resource to the access
control list (ACL) of the "Remote Sales" user group. The administrator creates ACLs on the Firebox SSL
VPN Gateway by adding resources to the network policies, application policies, kiosk policies, and end
point policies associated with the user group. The ACL is comprised of all policies that are assigned to a
user group on the Firebox SSL VPN Gateway.
Creating and Assigning Network Resources to the Engineering users
This section briefly discusses how the administrator creates a network resource and assigns it to the
Engineering users. This procedure is essentially the same as the procedure completed for the Sales
users in the previous step, except the administrator does not provide the engineering users with
access to the Sales Web application in the 10.60.10.0/24 network.
As noted earlier, the Engineering users need access to a Web conference server, an email server, and
several file servers. All of these servers reside in the network 10.10.0.0/24.
To provide the Engineering users with access to the network:
1 From the right pane of the Access Policy Manager tab in the Firebox SSL VPN Gateway
Administration Tool, create a new network resource named "Engineering Resources." Specify
only the 10.10.0.0/24 network when creating this resource.
2 In the left pane, expand the "Remote Engineers" user group.
3
Drag the "Engineering Resources" network resource from the right pane of the Access Policy
Manager tab to the Network Policies of the "Remote Engineers" group in the left pane.
The "Engineering Resources" Network Resource is now part of the ACL for the "Remote Engineers"
group.
In more complex environments, it may be necessary to restrict access to a particular segment of a larger
network. For example, an administrator may need to deny access to the 10.0.20.x network while
allowing access to everything else in the 10.0.x.x network. The administrator creates a network resource
for the 10.0.20.x network and a network resource for the 10.0.x.x network and assigns both network
resources to the user group. The administrator then right-clicks each of the resources to deny access to
Administration Guide
Scenario 1: Configuring LDAP Authentication and Authorization
Note
Note
167