Restricting users to the internet via usernames

Restricting users to the internet via usernames

U Case Requirements

How do I use the TMG firewall to restrict users to the Internet through usernames?

U Knowledge Tips

In the TMG firewall in addition to the IP address can restrict users to the Internet, but also through the user name limit users to the Internet, the user needs to be authenticated. In general, the following two cases are divided.

? Workgroup Environment

If TMG is not joined to a Windows domain, the user will need to be authenticated using a mirrored account, which is to create a user account with exactly the same user name and password on the TMG and the client, and TMG authenticates the user.

? Windows domain environment

If TMG is joined to a Windows domain, it is possible to restrict the accounts or groups that already exist in the ad directly, and the ad authenticates the user.

Here's how to add TMG to a Windows domain, in the following steps.

(1) Create a new group in AD, the group is named "Allow Internet users", and then add the user account that needs to allow Internet access to the group, as shown in 2.1.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image002 "border=" 0 "alt=" clip_image002 "src=" http://s3.51cto.com/wyfs02/M00/77/8B/ Wkiom1zpf1syaedaaaavbonak1w268.jpg "" 237 "height=" 244 "/>

Figure 2.1 Creating a new group

(2) Create a new user set in TMG, the user set name is "Allow Internet users", 2.2 is shown.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image004 "border=" 0 "alt=" clip_image004 "src=" http://s3.51cto.com/wyfs02/M01/77/8B/ Wkiom1zpf1xtiwruaaa27sstjjs425.jpg "" 244 "height=" 178 "/>

Figure 2.2 Creating a new user set

(3) In the Users window, click the Add button, and then select Windows Users and groups, click the Next button, 2.3.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image006 "border=" 0 "alt=" clip_image006 "src=" http://s3.51cto.com/wyfs02/M00/77/8A/ Wkiol1zpf1bgu4wwaaapmtrjwjc486.jpg "" 244 "height=" 175 "/>

Figure 2.3 Entering the rule name

(4) In the window shown in 2.4, select the new group in AD "Allow Internet users", then click the "OK" button, 2.5, and then click the "Next" button to complete the creation of the user set.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image008 "border=" 0 "alt=" clip_image008 "src=" http://s3.51cto.com/wyfs02/M02/77/8B/ Wkiom1zpf1bxuw5haaaqoi3jjuc195.jpg "" 244 "height=" "/>

Figure 2.4 Selecting a user or group

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image010 "border=" 0 "alt=" clip_image010 "src=" http://s3.51cto.com/wyfs02/M00/77/8B/ Wkiom1zpf1fqln9maaanrij2pyq059.jpg "" 244 "height=" 177 "/>

Figure 2.5 Completing the Add user

(5) Create a new access rule in TMG, add the new user set "Allow Internet users" on the "User set" page of the New Access Rule Wizard, delete the original user set "All users", 2.6, and then click the "Next" button to complete the creation of the access rule.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image012 "border=" 0 "alt=" clip_image012 "src=" http://s3.51cto.com/wyfs02/M00/77/8A/ Wkiol1zpf1jam8akaaat9b4xdxs021.jpg "" 244 "height=" 184 "/>

Figure 2.6 Selecting a user set

(6) If you want to enable user authentication, the client must be configured as a Web proxy or TMG Firewall client, and SecureNAT does not support authentication. In this case, the client is configured as a Web proxy client, as shown in 2.7.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image014 "border=" 0 "alt=" clip_image014 "src=" http://s3.51cto.com/wyfs02/M01/77/8B/ Wkiom1zpf1mijzdzaaa91a-30ea733.jpg "" 244 "height=" 184 "/>

Figure 2.7 Setting up a time plan

(7) On the client page, you will be asked to enter a user name and password to continue, as shown in 2.8. After correctly entering the "Allow Internet users" group in the account and password, you can browse the Web page, if you do not enter a valid user name and password, there will be 2.9 error page shown.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image016 "border=" 0 "alt=" clip_image016 "src=" http://s3.51cto.com/wyfs02/M02/77/8B/ Wkiom1zpf1qhva8maaaq34bhg0i935.jpg "" 244 "height=" 184 "/>

Figure 2.8 Asking for a user name and password

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; margin:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image018 "border=" 0 "alt=" clip_image018 "src=" http://s3.51cto.com/wyfs02/M01/77/8B/ Wkiom1zpf1ugoxekaaa3-ac6jzw402.jpg "" 244 "height=" 184 "/>

Figure 2.9 Error message

(8) Using account Zhangsan on the client computer to log on to the domain and then browse the Web page, the user can browse the Web page, as shown in 2.10.

650) this.width=650; "Style=" background-image:none; border-bottom:0px; border-left:0px; padding-left:0px; padding-right:0px; border-top:0px; border-right:0px; padding-top:0px "title=" clip_image020 "border=" 0 "alt=" clip_image020 "src=" http://s3.51cto.com/wyfs02/M00/77/8A/ Wkiol1zpf1yrkurwaaafgziyzha634.jpg "" 244 "height=" 184 "/>

Figure 2.10 Normal web browsing

Restricting users to the internet via usernames