User-Aware Access Control - ZyXEL Communications ZyWALL USG100-Plus User Manual

Chapter 3 Protecting Your Network
3.1.1 What Can Go Wrong
• The ZyWALL checks the firewall rules in order and applies the first firewall rule the traffic
matches. If traffic is unexpectedly blocked or allowed, make sure the firewall rule you want to
apply to the traffic comes before any other rules that the traffic would also match.
• Even if you have configured the firewall to allow access for a management service such as HTTP,
you must also enable the service in the service control rules.
• The ZyWALL is not applying your firewall rules for certain interfaces. The ZyWALL only apply's a
zone's rules to the interfaces that belong to the zone. Make sure you assign the interfaces to the
appropriate zones. When you create an interface, there is no security applied on it until you
assign it to a zone.

3.2 User-aware Access Control

You can configure many policies and security settings for specific users or groups of users. Users
can be authenticated locally by the ZyWALL or by an external (AD, RADIUS, or LDAP)
authentication server. Here is how to have the ZyWALL use a RADIUS server to authenticate users
before giving them access.
Set up user accounts in the RADIUS server.
1
Set up user accounts and groups on the ZyWALL (Configuration > Object > User/Group).
2
Configure an object for the RADIUS server. Click Configuration > Object > AAA Server >
3
RADIUS and double-click the radius entry.
Then, set up the authentication method, Click Configuration > Object > Auth. Method. Double-
4
click the default entry. Click the Add icon.
Configure the ZyWALL's security settings. The ZyWALL can use the authentication method in
5
authenticating wireless clients, HTTP and HTTPS clients, IPSec gateways (extended authentication),
L2TP VPN, and authentication policy.
3.2.1 What Can Go Wrong
• The ZyWALL always authenticates the default admin account locally, regardless of the
authentication method setting. You cannot have the RADIUS server authenticate the ZyWALL's
default admin account.
• The authentication attempt will always fail if the ZyWALL tries to use the local database to
authenticate an ext-user. An external server such as AD, LDAP or RADIUS must authenticate the
ext-user accounts.
• Attempts to add the admin users to a user group with access users will fail. You cannot put
access users and admin users in the same user group.
• Attempts to add the default admin account to a user group will fail. You cannot put the default
admin account into any user group.
46
ZyWALL USG100-PLUS User's Guide