Identity Awareness and Access Control
Core concepts
Identity Awareness ties users to IP addresses so rules can match users, groups, and roles instead of only IPs. Know the identity sources: AD Query, Browser-Based Authentication, Terminal Servers / Identity Agents, and RADIUS accounting. Understand the Identity Collector and how identities are shared across gateways.
Access control mechanics
Rules can use Source = Access Role / User / Group. Understand captive portal behavior, transparent vs explicit authentication, and how identity is resolved per connection. Know UserCheck for interactive user decisions and how Identity Awareness blades interact with other blades.
Traps in questions
- Assuming identity is known instantly - there is a resolution delay; first packets may be unidentified.
- Confusing AD Query (reads domain controller logs) with Browser-Based Auth (user logs in via portal).
- Forgetting that a user rule needs the Identity Awareness blade enabled on the gateway.
- Mixing up Access Roles (dynamic, group-based) with static user objects.
Worked example
A rule allows "Finance" group to a server. A user authenticates via the captive portal; the gateway maps their IP to the user identity, and subsequent connections match the rule. Until authentication completes, traffic may hit the Cleanup rule.