Controlling Internet Access: Introduction to TMG Access Rule - Part 2

Network Administration - In part two of this article series, I will go over the details of Access Rules after working together to create a rule using the wizard in Part 1 .

[#RelatedNews (8) #]

In Part 1 of this two-part series of Access Rules, we introduced you to the purpose and process of creating an Access Rule and how to use the Access Rule wizard for creating a rule. In this section, we will go over the details of Access Rules after going together to create with the wizard in Part 1. We want to do this because there are some settings that are not revealed in Access Rule. wizard.

If you double click on an access rule after creating it, you will see the Properties dialog box for the rule that appears. The first tab you will see is the General tab. Here you can rename the rule's name and provide a description for it. We see the description is very useful, because you can demonstrate by document the purpose of the rule, who created the rule, when the rule was created, and why it was created, such as someone has requested. create a rule or some business issue it needs to solve.

Note that the Evaluation order is in this tab. However, you need to know this is the evaluation order for the list of firewall rules outside of the System Policy rules. System Policy rules are always evaluated before policy rules. You can also enable or disable the rule by using the Enable checkbox.

On the Action tab, you have several options:

On the Protocols page, you have several options similar to those included in the Access Rule wizard. The This rule applies to checkbox also provides the same options and you can use the Add , Edit and Remove buttons to edit, add, and remove protocols that will apply to this rule. You also have the available Ports option. The Filtering button, when enabled, allows you to configure the HTTP Policy for the rule (if it is an HTTP rule). This feature is grouped into earlier versions of ISA firewall, better known as HTTP Security Filter . There may also be other filters - depending on the protocol you use - if the filter may apply to outgoing protocols. Most of the protocol filters we have with TMG are designed to protect inbound connections, but there are a number of implications for outgoing protocols.

On the From tab, you can define the sources that the rule will apply to. There are many clients located on TMG protection network. This option is similar to what you see in the Access Rule wizard. When you click Add, you will see the Add Network Entities dialog box and you can choose from several network entries or create new entries. An option available in this tab but not in the Access Rule wizard is the Exceptions section. Here you can set the sources that you want the rule to apply to, but there is a subset within that group that is the exception, you can put those exceptions in the Exceptions section. This is a powerful option and sometimes needs to be noted in designing your Access Rules.

The To tab is similar to the From tab , where you define the destination you want the rule to match. When you click Add, you will see the Add Network Entities dialog box, you can select the destination from the list or you can create a new destination. As shown in the From tab, you also have the option to create Exceptions exceptions .

---

On the Users tab, you can define which rule will apply to which user. By default, All Users is the user set used for Access Rules. It should be noted that All Users here does not really mean all users but just anonymous connections and authenticated connections - so it means 'user scope is not considered'. If you want to force the user to authenticate, you need to use another set of users and remove the All Users user set.

If you click Add, you can select All Authenticated Users and only users who can authenticate with the TMG firewall will be allowed to access this rule. Authentication can be done through the client's web proxy configuration or the Client Firewall (TMG client) configuration. If you want to create your own user set, click the New button.

When you click New , the program will start Welcome to the New User Set wizard. On the first page of the wizard, enter a name for the user set. In this example, we will create a user set that includes the Domain Admins Active Directory group, so name this rule as Administrators and click Next .

On the Users page, when you click Add, a menu will appear. This menu includes the following authentication sources:

In this example, the TMG firewall joined the Active Directory domain, so we will select Windows users and groups .

You will see the Select Users or Groups dialog box appear. We enter the Domain Admins into the text box Enter the object names to select and click Check Names and then click OK to add this Active Directory group to the user set.

You will see the new user set on the Users page. You can add more users to this user set if you like. In this example, we will click Next and do not add anyone to this user set.

On the Completing the New User Set Wizard page, click Finish to create a new user set.

At this point, you can create the Administrators group in the Add Users dialog box and you can use this group in Access Rules and publish rules.

---

On the Schedule tab, you can set a schedule for the rule to set how long the rule will apply. Note that when you define a schedule, the schedule will only be applied to new connections in case the user is connected before the schedule expires, then the user's connection will not be broken. . However, if a new connection attempt matches the rule outside the schedule, the connection will be rejected. The default schedule is always Always , but there are two other accompanying schedules: Weekends and Work hours . If you don't like these included schedules, you can click the New button and create a custom schedule.

The Malware Inspection tab is a tab only available on the TMG firewall. There are several options on this tab that are not exposed in the Access Rule wizard:

 

On the Edit Rule Malware Inspection Settings page, you have several options. The following figure shows the default settings:

 

Conclude

In this article, I have explained the details of Access Rules. Most of the options you want to configure have been exposed in the Access Rule Wizard, but there are other important options that can only be accessed after you have created the rule, by accessing the box. The rule's Properties dialog. We hope this series of two parts will be helpful to you, especially those who are new to the TMG firewall, and this information will help you create the right access policies. organize yourself.