Managing Users and Objects
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.25 Locally Managed Administration Guide | 241
Managing Users and Objects
This section describes how to set up and manage users (User Awareness, users, administrators, and
authentication servers) and network resources.
Working with User Awareness
In the
User Awareness
page you can turn the blade on or off and use the configuration wizard to configure
sources to get user identities, for logging and configuration purposes.
User Awareness lets you configure the Check Point Appliance to show user based logs instead of IP
address based logs and enforce access control for individual users and user groups.
To use User Awareness, you must configure identification methods to get information about users and
user groups. After the gateway acquires the identity of a user, user-based rules can be enforced on the
network traffic in the Access Policy.
User Awareness can use these sources to identify users:
n
AD Query (Active Directory Queries) - Seamlessly queries the Active Directory servers to get user
information.
The Check Point Appliance registers to receive security event logs from the AD domain controllers
when the security policy is installed. This requires administrator privileges for the AD server. When a
user authenticates with AD credentials, these event logs are generated and are sent to the Security
Gateway. The Check Point Appliance can then identify the user based on the AD security event log.
n
Browser-Based Authentication - Uses a portal to authenticate either locally defined users or as a
backup to other identification methods.
Browser-Based Authentication uses a web interface to authenticate users before they can access
network resources or the Internet. When users try to access a protected resource, they must log in
to a web page to continue. This is a method that identifies locally defined users or users that were
not successfully identified by other methods. You can configure the Browser-Based Authentication
to appear for all traffic but because this method of identification is not seamless to the end users, it is
commonly configured to appear when you access only specific network resources or the Internet to
avoid the overhead required from end users when they identify themselves. For traffic that is not
HTTP based, you can also configure that all unidentified are blocked from accessing the configured
resources or Internet until they identify themselves first through the Browser-Based Authentication.
To enable or disable User Awareness:
Select the
On
or
Off
option.
Note
- When the blade is managed by Cloud Services, a lock icon is shown. You cannot toggle between the
on and off states. If you change other policy settings, the change is temporary. Any changes made locally
are overridden in the next synchronization between the gateway and Cloud Services.
Use the User Awareness configuration wizard to enable and configure the blade. You can configure the
basic details of the identity sources. After initial configuration, you can select the
Active Directory Queries
or
Browser-Based Authentication
checkboxes under Policy Configuration and click
Configure
to
configure more advanced settings.
