FSSO group to restrict access to internet only

[#1]

Hi, I have a Fortigate 80c with mr3 patch 1 running on it. I have setup FSSO agent and it has picked the groups from AD. There is a custom group called Deny Internet Access. Im not sure what steps are needed to configure this sort of access. That group wont be needing acess to internet ONLY, but would still need to be able to send/receive emails. At the moment we have an outbound and inbound policy allowing access to any server and destination as any. Please suggest. Thanks

[#2]

Anyone?

[abelio]

Hi, I cannot see where' s the problem then; just define a group services like = dns, imap,smtp,pop3 if that are services you' re interested in and apply them to the firewall policy controlling the internet access for such group.

[discoveryit]

What we do is create a Identity Based Policy for that User Group. Then set a Web URL Filter to .* blocked. That will block all websites from the systems with those users.

[#5]

So when we create an Identity based manager policy, does the policy need to be on the top of my firewall policy list? Also, should I only define that policy to restrict internet access to just outbound or inbound rule or both?

[#6]

Hi, I cannot see where' s the problem then; just define a group services like = dns, imap,smtp,pop3 if that are services you' re interested in and apply them to the firewall policy controlling the internet access for such group.

But do we still need to turn on ID based manager policy for the above services? Also, does the rule have to be on the top of the list of the fireall policy? Thanks

[rwpatterson]

Policies are read from the top down, so the first good hit gets the traffic. With identity based policies, any traffic below that shares the same source/destination pair will never get hit, so you will need to include any other groups in that policy that may need Internet access.