WatchGuard Firebox System 4.6 User Guide

Using authentication to define remote user VPN access8 Click OK.Using authentication to define remote user VPN accessWatchGuard uses two built-in Firebox groups to identify currently active remote uservirtual private network users.• pptp_users – Names authorized to use Remove User VPN with PPTPFor more information, see “Adding remote access users” on page 134.• ipsec_users – Names authorized to use Mobile User VPN with IPSecWhen a user successfully connects to the Firebox using Remote User VPN,WatchGuard automatically adds the assigned IP address to one of these built-inaliases (depending on the VPN method). When the user shuts down the VPN session,WatchGuard automatically removes the address associated with that user from thealias.When a Remote User VPN connection is made to the Firebox, WatchGuard checks theclient’s username and password against the Firebox domain. For this reason, RemoteUser VPN users must have an account in the Firebox domain and must be a memberof the appropriate VPN group for access, regardless of any other authenticationscheme in use.When users authenticate using their account in the Firebox domain, WatchGuardautomatically adds their IP address to all Firebox domain groups of which they are amember, including pptp_users or ipsec_users.By default, Remote User VPN users (or any users) have no access privileges through aFirebox. To allow Remote User VPN users to access machines on the Trustednetwork, you must add their usernames (or the group alias) to service icons in theServices Arena.A typical use of built-in groups is to allow incoming connections to certain Trustedservers from the pptp_users or ipsec_users group members. This is an easy way toprovide outside access to critical machines inside your network, withoutcompromising general security.Example: Configuring a service for Remote User VPNTo allow outgoing Telnet but only allow incoming Telnet if the request comes from aRemote User VPN user, follow this procedure:From Policy Manager:1 Add a Telnet icon to the Services Arena if one does not already exist.For information on how to add services, see “Adding an existing service” on page 47.2 Configure the Outgoing tab to allow from Any to Any.3 Configure the Incoming tab to allow from pptp_users to Any.4 Click OK.92