CHAPTER 8: About Security Policies
188 Vcontroller
Conceptually, security policies that incorporate the same
VLAN object will be grouped into the same policy domain.
Although Vcontroller does not require all policies with the
same VLAN object to be grouped together in the Policy
Manager security policy table, WatchGuard recommends
that you do so for better policy management.
N
OTE
The current line of Firebox Vclass appliances recognize
VLAN/802.1Q headers in data for routing purposes.
User domain tenant authentication
Two types of tenant authentication can be applied in a user
domain multi-tenant policy:
Manual authentication
The client user supplies three required entries by
means of a Web browser form: a user name, a
password, and a domain name.
Certificate-based authentication
A pre-installed VPN certificate automatically
supplies the client user name and domain name.
The password must be manually entered by the
user. This certificate must be imported by an IT
administrator into the client system’s Web browser
(which is required for all secure access).
After the three entries are supplied to the Firebox Vclass
appliance, the appliance initiates a RADIUS system
authentication request to check the user name and pass-
word. Note, however, that Firebox Vclass appliances can-
not perform tenant authentication because they have no
database for this purpose.
After a user domain tenancy is established for relevant
users, and the RADIUS system is loaded with authentica-
tion data for the potential users, the actual network con-
nections are managed in this manner:
• The user opens his or her browser and attempts to
connect to the Firebox Vclass appliance.
To Next Page
