Restrict internet once logged in through RA or SNX

[Blason_R]

Hi Team,

Is there any way to restrict users internet once they logged on to RA vpn or SNX? I know one way is route the entire internet traffic through firewall and no nat rule for Office mode or force fake proxy entry to browsers so that they wont be able to browse the internet.

However it seems those are global settings and I am looking if this can be done for certain users?

[PhoneBoy]

As those are global settings, you can't make them apply to specific users: it's all or nothing.
However, a Desktop Policy (using Endpoint Security VPN or Harmony Endpoint) can block browsing to the Internet on the client without having to route all traffic. 

[Blason_R]

Thanks for the reply - In this case I would need separate EPM server? or Desktop security policy option checked?

[PhoneBoy]

Either option should work (depends on if you use EPM or not).

[the_rock]

I think you could use desktop policy, for sure. But, why not just create RA groups and then set up regular policy rules to restrict access?

Just a thought..