active and passive auth policy

[sims]

Why "all and guest group" in the source , What if we give "guest group  " only 

Thanks

[lobstercreed · Accepted solution]

Completely different objects.  "all" is an address object, Guest-group is a user object, and they use AND logic.  If source is <address> AND user is <user/group>, then match this.  Without a source address object there would be no traffic to match.  You of course don't have to use "all" but you must use some address object that catches the traffic you're after.