https://community.checkpoint.com/t5/Firewall-and-Security-Management/Identity-Awareness-Access-Role-Objects/m-p/67138#M12289 <P>Hello,&nbsp;</P><P>With regards to creating Identity Awareness Access Role Objects, if two or more objects are added i.e. a network and an AD user group, do only one or both attributes have to match for the user to be granted access?</P><P class="tpbodytext">&nbsp;</P><P class="tpbodytext">From R80.10 administration documentation:</P><P class="tpbodytext">In Smart Console, you can create Access Role objects to define users, computers and network locations as one object.</P><P class="tpbodytext">You can use Access Role objects as a source or a destination parameter in a rule.</P><P class="tpbodytext">Access Role objects can include one or more of these objects:</P><UL><LI>Networks</LI><LI>Users and user groups</LI><LI>Computers and computer groups</LI><LI>Remote Access Clients</LI></UL><P>&nbsp;</P><P>Regards,</P><P>Simon</P> Tue, 12 Nov 2019 00:43:24 GMT Simon_Macpherso 2019-11-12T00:43:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Identity-Awareness-Access-Role-Objects/m-p/67138#M12289 <P>Hello,&nbsp;</P><P>With regards to creating Identity Awareness Access Role Objects, if two or more objects are added i.e. a network and an AD user group, do only one or both attributes have to match for the user to be granted access?</P><P class="tpbodytext">&nbsp;</P><P class="tpbodytext">From R80.10 administration documentation:</P><P class="tpbodytext">In Smart Console, you can create Access Role objects to define users, computers and network locations as one object.</P><P class="tpbodytext">You can use Access Role objects as a source or a destination parameter in a rule.</P><P class="tpbodytext">Access Role objects can include one or more of these objects:</P><UL><LI>Networks</LI><LI>Users and user groups</LI><LI>Computers and computer groups</LI><LI>Remote Access Clients</LI></UL><P>&nbsp;</P><P>Regards,</P><P>Simon</P> Tue, 12 Nov 2019 00:43:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Identity-Awareness-Access-Role-Objects/m-p/67138#M12289 Simon_Macpherso 2019-11-12T00:43:24Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Identity-Awareness-Access-Role-Objects/m-p/67192#M12290 One of each attribute specified has to match to be considered part of the access role.<BR />So, for instance, if you specify a network and a user group, it has to be someone in that user group on the specified network. Tue, 12 Nov 2019 14:53:55 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Identity-Awareness-Access-Role-Objects/m-p/67192#M12290 PhoneBoy 2019-11-12T14:53:55Z