Example VPN configuration 3: create Access rules

Create a rule to allow specific users access to internal networks after having authenticated.

The authentication connection from VPN clients is allowed in the Firewall Template. Authentication is always required to establish a VPN tunnel. VPN client connections are matched based on Source, Destination, and Service like any other traffic. The example rule matches only specific users and only after the users have already successfully authenticated. We recommend always adding the authentication requirement to rules that are specific to VPN clients.

After the VPN tunnel is established, any connection from the VPN clients to the internal network is matched against the Access rules as usual. The example rule that is created here allows these connections.

Note: This configuration scenario does not explain all settings related to VPN Access rules.

Steps

  1. Select Engine Configuration.
  2. Browse to Engine > Policies > Engine Policies.
  3. Right-click the Engine policy that is used by the Engines involved in the VPN, then select Edit Engine Policy.
  4. Add an IPv4 Access rule in a suitable location in the policy and configure the rule as outlined here:
    Table 1. Example VPN rule
    Source Destination Service Action Authentication
    Network element that represents the virtual IP address range for the VPN Client Local internal networks Set as needed. Select Allow, then open the Action options. Set VPN Action to Enforce VPN, then select a Policy-Based VPN.

    Users tab: stonegate Internal User Group (under InternalDomain).

    Authentication Methods tab: ANY or a specific method.
  5. Save the policy.
  6. Refresh the policies of all Engines involved in the VPN to activate the new configuration.

Result

The VPN is established when traffic matches the created Access rules. Example VPN configuration 3 is now complete.