topic Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal in Firewall and Security Management

Mobile Access - AD users not belonging to an access role have access to mobile access portal

constant69 — Sun, 08 Nov 2020 19:58:26 GMT

Hi team,

I need your help on this matter.

Here is the environment

R80.40
Dedicated Management
Cluster of 5600

We are using MS Active Directory Integration with Access Mobile Access and we defined access role.

But, AD users not belonging to an access role have access to mobile access portal, why ? In the log we see in the usergroup_-"user do not belong to any group".

I want to know if this is an expected behaviour ? from my understanding, an Access Role is how the firewall determines what users are allowed access and those that are not define will be dropped.

Regards

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

PhoneBoy — Mon, 09 Nov 2020 01:23:15 GMT

It may be depending on how you've configured it.
Screenshots of the relevant configuration would be helpful.

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

constant69 — Mon, 09 Nov 2020 12:49:56 GMT

Hi PhoneBoy,

Thank for your reply.

This is a basic configuration in R80.40 ( I have the same behavior in my lab R80.10)

- 2 Access roles

- 2 rules with the both access roles in the source and mobile access application

I have attached screenshots

Regards

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

Wolfgang — Mon, 09 Nov 2020 10:24:45 GMT

@constant69

are the users with no group-mebership able to login only and did not see any MOB-defined application ?

Wolfgang

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

constant69 — Mon, 09 Nov 2020 12:47:44 GMT

Hi,

The users with no group-membership are able to login only and they did not see any MOB-defined application,

Regards

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

Wolfgang — Mon, 09 Nov 2020 13:40:54 GMT

Ok, looks like expected behaviour.

If the gateway is member of the remote access community and the "participant user groups" ist set to "all users" this is working as designed.

The users can authenticate but have no access to any MOB application or VPN connection.

If you want to limit to a specific usergroup you have to define them and replace the "all users". If you don't use any remote-access VPN on your gateway (SSL extender, checkpoint mobile etc.) you can remove the gateway from the remote access community.

Wolfgang

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

constant69 — Mon, 09 Nov 2020 13:48:24 GMT

Thank for your help on this matter.

To sum up, as we cannot select Access Roles, the following procedure is relevant
1) Create a ldap group that containt the AD users allowed
2) Then, select the previous ldap group in the remote access community

Regards

Re: Mobile Access - AD users not belonging to an access role have access to mobile access portal

constant69 — Tue, 10 Nov 2020 15:02:34 GMT

Hi Wolfgang,

Thank for your help on this matter: that solved my issue!

Regards