Restrict Remote VPN to a specific AD Group with NCC

LESPIAUC_Info_40

Hi,

I try to restrict Remote VPN to a specific AD group but I can't do it.

Here is screenshots of my configuration :

Do I've made a mistake ?

Thks

LESPIAUC_Info_40

Any ideas ?

Zyxel_Melen

Hi @LESPIAUC_Info_40,

I did a local lab with your security policy. Based on these security policies, the VPN connection will always hit the deny rule, since the VPN user information hasn't learned on firewall.

For workaround, we can set some rules to block VPN traffic for non-VPN group users. Below is the example:

For your original purpose, I'm checking with our engineer. I will update you once I get an update.

Zyxel_Melen

Update:

There is a workaround for this requirement:

1. Create an user that can only access specific OU, like OU = vpnuser. Other privileges like cn=users, please remove them.
2. Use this user to setup "authentication service > My AD server".
3. Use this authentication method for the remote access VPN, this allows to authenticate the AD user that in specific OU.