What's the best approach to filtering (Allow/Deny) access to specific terminals for VPN users?

phphil
phphil Posts: 39  Freshman Member
First Comment Friend Collector Fifth Anniversary
edited April 2021 in Security
Currently we have some ipsec ikev2 gateway which are allowed to connect to a certain LAN, and some other that are allowed to connect to an other LAN. But they always have access to the whole LAN they join (they can reach all the terminals inside that LAN)

We have many entries under Configuration > Security Policy > Policy Control
Close to the end, the following rule which I believe was created by default by firewall. 


Probably it is the rule allowing to access the whole LAN. 
What's the best approach to filtering, and allow VPN user to reach only the specified Address Group? 

All Replies

  • Briz
    Briz Posts: 20  Freshman Member
    First Comment Friend Collector Second Anniversary
    ...follow
  • Zyxel_Jeff
    Zyxel_Jeff Posts: 1,320  Zyxel Employee
    100 Answers 500 Comments Friend Collector Fourth Anniversary

    Hi @phphil

    Step1. you can add address object group(e.q. IP address, FQDN).

    Step2. This policy’s Destination field choose that address group which you created on Step1.



Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）