Kerio Tech Firewall6 Uživatelský manuál stáhnout pdf (Strana 371)

23.5 User accounts and groups in traﬃc rules

371

Such a rule enables the speciﬁed users to connect to the Internet (if authenticated).

However, these users must open the WinRoute interface’s login page manually and au-

thenticate (for details, see chapter 8.1).

However, with such a rule deﬁned, all methods of automatic authentication will be in-

eﬀective (i.e. redirecting to the login page, NTLM authentication as well as automatic

authentication from deﬁned hosts). The reason is that the automatic authentication (or

redirection to the login page) is not invoked unless connection to the Internet is being

established (for license counting reasons — see chapter 4.6). However, this NAT rule

blocks any connection unless the user is authenticated.

Enabling automatic authentication

The automatic user authentication issue can be solved easily as follows:

• Add a rule allowing an unlimited access to the HTTP service before the NAT rule.

Figure 23.9 These traﬃc rules enable automatic redirection to the login page

• In URL rules (see chapter 10.2), allow speciﬁc users to access any Web site and deny

any access to other users.

Figure 23.10 These URL rules enable speciﬁed users to access any Web site

User not authenticated yet who attempts to open a Web site will be automatically redi-

rected to the authentication page (or authenticated by NTLM, or logged in from the

corresponding host). After a successful authentication, users speciﬁed in the NAT rule

(see ﬁgure 23.9) will be allowed to access also other Internet services. As well as users

not speciﬁed in the rules, unauthenticated users will be disallowed to access any Web

site or/and other Internet services.

1 2 ... 366 367 368 369 370 371 372 373 374 375 376 ... 397 398

Žádné komentáře

Kerio Tech Firewall6 Uživatelský manuál Strana 371