Table 40: Group Expression Operators; Configuring Group Expressions - Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual

Network and Security Manager Administration Guide

Configuring Group Expressions

410
For Start IP, enter 1.1.1.1.
For End IP, enter 1.1.1.10.
In the IP Pool dialog box, click the Add icon to configure the second IP pool range. The
4.
New IP Pool Name dialog box appears. Configure the Start IP and End IP, then click
OK:
For Start IP, enter 2.2.2.2.
For End IP, enter 2.2.2.20.
Click OK again to save the IP Pool object and return to Object Manager.
5.
Group expressions are statements that set conditions for authentication requirements,
enabling you to combine multiple external user objects. You can create group expressions
using the operator OR, AND, or NOT to combine user objects, user group objects, or other
group expressions to define:
Alternatives for authentication ("a" OR "b" )
Requirements for authentication "a" AND "b" )
Exclusions of a user group, or another group expression (NOT "c" ).
NOTE: The user and user groups you reference in the group expressions
must be external users that are stored on an external RADIUS server. (A
RADIUS server enables a user to belong to more than one user group).
The operators have different meanings depending on the type of user object you are
using in the security policy, as listed in Table 40 on page 410.

Table 40: Group Expression Operators

User Objects
OR If the security policy defines authentication for "a" or "b" user objects, the security
device authenticates the user if it is either "a" or "b" .
AND Requires one of the two objects in the expression to be either a user group or a group
expression (a single user cannot be both user "a" and user "b" ). If the security policy
defines authentication for "a" AND a member of group "b" , the security device
authenticates the user only if those two conditions are met.
NOT If the security policy defines authentication for any user object that is not the "c" user
(NOT "c" ), the security device authenticates all users except the "c" user.
Copyright © 2010, Juniper Networks, Inc.