Cisco Cisco Web Security Appliance S170 사용자 가이드

You might want to grant different levels of access control to different users. For example, you might need 
to allow marketing users to access partner websites, but block engineering users from accessing partner 
sites. When users are authenticated against an authentication server, such as Microsoft Active Directory, 
and the authentication server has different user groups defined, you can create different policies for 
different user groups. 

In this task, you will create two Access Policies that apply to users in different Active Directory user 
groups. One policy will be for Marketing users and the other for Engineering users.

This task assumes that an NTLM authentication realm is defined on the Web Security appliance that 
references an Active Directory server with configured user groups.

To create Access Policies that apply to different Active Directory user groups:

Navigate to the Web Security Manager > Identities page.

Click Add Identity.

In the Name field, enter a name for this policy, such as 

.

In the Insert Above field, verify this Identity is below all other Identities that do not require 
authentication.

In the Define Members by Authentication section, choose “Require Authentication” from the drop down 
menu.

In the Select a Realm or Sequence field, choose the NTLM authentication realm already defined on the 
appliance.

In the Define Members by Protocol section, choose “HTTP/HTTPS Only.” This is because 
authentication is not supported with native FTP transactions.

Use the default values for all other settings, or optionally, change them as needed by your organization.

Click Submit.

Navigate to the Web Security Manager > Access Policies page.

Click Add Policy.

In the Policy Name field, enter a name for this policy, such as 

.

In the Identities and Users field, choose “Select One or More Identities.”

In the Identity field, select the Identity created in 

.

Under Authorized Users and Groups for the NTLM authentication realm, choose “Selected Groups and 
Users” and then click the link next to “Groups.”

On the Access Policies: Policy “PolicyName”: Edit Groups page, add user groups to the Authorized 
Groups section. You can do this using any of the following methods:

Select a user group in the directory search list window and either double-click or click Add.

Type the entire group name in the Directory Search window, and after the search is complete, click 
Add. This allows you to enter groups that do not appear in the directory search list, such as groups 
that belong to a trusted domain or groups that are not yet available in the directory.

Click Done.

Click Submit.