If I'm understanding you correctly, yoiu're using "WLAN user" synonomously with "remote" user because you're talking about home use.
Are you talking about a remote user at home who needs to use the Internet but you don't want them to use the Internet unless they are using SecureClient and logged in? Is it that you want them to have two paths simultaneously: SecureClient to your network and web browsing to the Internet (split tunneling)?
I know this is almost a religious argument, but that's a really bad idea. It would mean someone on the Internet could gain remote access to the at-home computer and get into your internal network at the same time.
The only way I can see for this to work would be to set a desktop security rule so people in [EMAIL PROTECTED] can have ACCEPT OUTBOUND to HTTP, HTTPS, and FTP.
Ray
From: Geoff Brisbine <[EMAIL PROTECTED]> Reply-To: Mailing list for discussion of Firewall-1 <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: [FW-1] Allow all outgoing traffic after authenticated via SecureClient Office-Mode? Date: Tue, 4 May 2004 20:12:06 -0500
Greetings again, all.
Now that our office-mode WLAN users can connect via SecureClient thru two separate interfaces (WLAN and outside) by disabling office-mode anti-spoofing it's time for me to get those users connecting to the internet.
Currently, the only way that the WLAN users can connect to the internet is if the "Route all traffic thru gateway" is set. That isn't realistic because when a user is at home I don't want all their traffic eating up our bandwidth. I don't have any rules allowing traffic from the WLAN IP addresses to the outside. The rules I've have for SR/SC are as follows...
# | Source | Dst | VPN | Service | Action ---+-------------------+-----+--------------+----------------+---------- 50 | [EMAIL PROTECTED] | Any | RemoteAccess | Any | accept 51 | [EMAIL PROTECTED] | Any | Any Traffic | http,https,ftp | User Auth 52 | [EMAIL PROTECTED] | Any | RemoteAccess | Any | accept 53 | [EMAIL PROTECTED] | Any | Any Traffic | http,https,ftp | User Auth
If I have the "Route all traffic thru gateway" set and I hit Yahoo from a machine it is allowed via Rule 50 (I'm in the Admins group). However, if I don't have "Route all..." set and I try to hit Yahoo from the office-mode WLAN it is blocked by my Any-Any drop rule at the bottom of my ruleset. That is presumably because I don't have a rule from the WLAN IPs to the Internet. The only time I want WLAN IPs to have access to the Internet is if they are authenticated via SR/SC.
Is it possible to simultaneously 1) Not have "Route all traffic thru gateway" set, but still 2) Only allow outgoing internet traffic to those that have authenticated via SR/SC?
I know that when the users are on the WLAN that all traffic /will/ be routed thru the gateway, but if it's not in the encryption domain I don't care about it being encrypted by SR/SC.
I would be happy to provide any additional information.
Thanks!
Geoff Brisbine | Network Administrator
MI-Assistant - A Division of Fiserv FSC, Inc. 26550 West Mondovi Street | Eleva, WI 54738 Phone: 715.287.4262 | Fax: 715.287.4576
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
_________________________________________________________________ Watch LIVE baseball games on your computer with MLB.TV, included with MSN Premium! http://join.msn.com/?page=features/mlb&pgmarket=en-us/go/onm00200439ave/direct/01/
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
