WatchGuard Technologies SSL VPN Benutzerhandbuch
Administration Guide
105
Configuring Resources for a User Group
8
If you selected Process Rule, do the following:
- Click Process Rule.
- In Process Name, type the name of the process or click Browse to navigate to the file.
The MD5 field is automatically completed when a process name is entered.
9
Click OK.
Note
For information about adding an end point policy to a user group, see “Configuring an end point policy
for a group” on page 105.
for a group” on page 105.
To delete an end point resource
1
Click the Access Policy Manager tab.
2
In the right-pane, right-click the end point resource you want to remove and then click Remove.
Configuring an end point policy for a group
The Firebox SSL VPN Gateway Administration Tool allows you to construct an expression by dragging
and dropping the end point resource into the End Point Policy Expression Generator. When you drag
and drop resources into the generator, the Boolean expression is created automatically for you. Expres-
sions can be modified at any time.
To configure an end point policy for a group, you specify a Boolean expression containing the end point
resources that you want to apply to the group.
Suppose that you create the following end point policies:
and dropping the end point resource into the End Point Policy Expression Generator. When you drag
and drop resources into the generator, the Boolean expression is created automatically for you. Expres-
sions can be modified at any time.
To configure an end point policy for a group, you specify a Boolean expression containing the end point
resources that you want to apply to the group.
Suppose that you create the following end point policies:
• CorpAssetRegistryEntry
• AntiVirusProcess1
• AntiVirusProcess2
• AntiVirusProcess1
• AntiVirusProcess2
Your end point policy expression might specify that a registry check must verify that the resource
attempting to connect is a corporate asset and that the resource must have one of the antivirus pro-
cesses running. That Boolean expression is:
(CorpAssetRegistryEntry & (AntiVirusProcess1 | AntiVirusProcess2))
Valid operators for end point policy expressions are as follows:
attempting to connect is a corporate asset and that the resource must have one of the antivirus pro-
cesses running. That Boolean expression is:
(CorpAssetRegistryEntry & (AntiVirusProcess1 | AntiVirusProcess2))
Valid operators for end point policy expressions are as follows:
For users without administrative privileges, end point policies fail if the policy includes a file in a
restricted zone (such as C:\Documents and Settings\Administrator) or if the policy includes a restricted
registry key.
If a user belongs to more than one group, the end point policy applied to the user is the union of the
expression for each of the user’s groups.
restricted zone (such as C:\Documents and Settings\Administrator) or if the policy includes a restricted
registry key.
If a user belongs to more than one group, the end point policy applied to the user is the union of the
expression for each of the user’s groups.
To create an end point policy for a group
1
Click the Access Policy Manager tab.
( ) - used to nest expressions to control their evaluation
& - logical AND
|
- logical OR
!
- logical NOT