topic Re: cloud SMP role definitions in Spark Firewall (SMB)

cloud SMP role definitions

Ted_Serreyn — Sat, 17 Apr 2021 19:32:16 GMT

OK so I am finally getting back to re-evaluating cloud SMP for my users that are purchasing 1500 appliances.

I would like a user to be able to login and only see his devices/plans/roles on the cloud SMP. He should not be able to see any other users gateways.

At this time I am not worried about the user seeing logs for other gateways.

Is this even possible? I am trying to filter using the Intersects(gateways, CurrentUser.gateways), however I must not be giving enough access, it appears that we need access to user and all gateways to see this. This is from the SMP 12.30 Admin guide P111?

Anyone ever do this kind of access role? I am trying to understand all the fields that we could match.

Is it possible to match on a user field, for example user->custom field->UserGroup access and gateway->custom field -> GWgroup, then give access if CurrentUser.UserGroup == Gateway.GWgroup?

Cloud SMP 12.30

Re: cloud SMP role definitions

PhoneBoy — Wed, 21 Apr 2021 01:41:02 GMT

From what the experts tell me, this is not possible with SMP currently.
You can't give access to specific gateways, only specific actions within the SMP with apply to all gateways.
The only way to achieve this at the moment is for the user to connect to their gateway (either directly or via Reach My Device).

Re: cloud SMP role definitions

G_W_Albrecht — Wed, 21 Apr 2021 08:10:20 GMT

Every user buying a 1500 gets one Cloud Management license for it included in the deal. So he has his own Cloud Management and therefore will see no other GWs.

Re: cloud SMP role definitions

Ted_Serreyn — Thu, 22 Apr 2021 16:34:53 GMT

And why would I want every customer that needs help managing their firewall in their own SMP? That kind of defeats the purpose. I don't want to login to every firewall, so I want to use SMP. Because of this I don't want to login to every different SMP portal.

I want to work smarter, not harder.

Re: cloud SMP role definitions

Ted_Serreyn — Thu, 22 Apr 2021 16:38:43 GMT

It is possible, we have done it. The key is the access roles rule for Gateways. Matches(name,"gwprefix.+")