topic Re: Defining access per user in SASE and Remote Access

Defining access per user

abihsot__ — Wed, 20 May 2020 10:34:14 GMT

Hi there,

In mobile access portal policy you can add singe user and not necessary use LDAP group and it works just fine.

I tried to achieve the same for remote access for VPN users and I couldn't find a way to do this. I could add only LDAP group, but not single user. Is there a way to do this?

Re: Defining access per user

Wolfgang — Wed, 20 May 2020 10:54:03 GMT

If you want to allow only a single user you have to use access-roles as source in your policy.

Create a role for every user you need and add only the user in the access-role. These users can't be internal users, they can be added only if they defined in a directory referenced by an account unit.

Wolfgang

Re: Defining access per user

abihsot__ — Wed, 20 May 2020 11:04:43 GMT

This means I need to enable Identity Awareness blade on the gateway to use access roles. The gateway having Mobile Access do not have Identity Awareness enabled. Thanks for suggestion, I'll give it a try.

Re: Defining access per user

Norbert_Bohusch — Wed, 20 May 2020 12:50:44 GMT

Legacy User Access should not be used anymore and Identity Awareness is anyway the recommended way for creating Remote Access rules.
As soon as you want to move to a unified policy, the Legacy User Access objects aren't working/supported and you will not be able to install policy anyway.

Re: Defining access per user

abihsot__ — Wed, 27 May 2020 14:55:22 GMT

Noted, thanks!