Howto combine 'Match known users' and 'Block clients with no heartbeat'

Hi FFin ,

Thank you for reaching out to the community, Sophos Firewall communicates with the Sophos Central IP address, 52.5.76.173, on port 8347 for heartbeat communication.

So you can create a rule action accordingly.  "Block Clients without Heartbeat" = NAC with Sophos Endpoint.

Green/Yellow/No Restriction Minimum = In Case you clients only with a certain HB status in your network communicating. 

You need only one rule. Its not a selection criteria, instead only a on top control feature for your desired network.

You want only HB Clients to communicate through XG? Select the checkbox, XG will block everything else, what does not have a Endpoint installed. 

You want only green HB Clients talking to WAN? Select green as minimum requirement and block everything without. 

You have a mixed setup, some clients with EP, some without in one network. Dont select to block Clients without and use HB only if available. 

Hi Vivek Jagad , 
thanks - that's clear. But i'm looking for information, if "match know users" will match first or not - in combination with block heartbeat.
So will "Block Clients without Heartbeat" only be checked for matching users or all selected source-network objects before, regardless what users.

that is better a option with source-network object regardless what users FFin 

that is better a option with source-network object regardless what users FFin 

Okay, i think i need a more specific example:

Will this rule block all traffic from LAN-Zone to Server-Zone without heartbeat?
Or will this rule block only the traffic without heartbeat for matching user 'florian'?

So traffic not matching user 'florian' will be blocked due to missing heartbeat or not?

By selecting this will only identify Florian as a matching criterion. You can refer the details of the options here.
For better understanding refer - Synchronized Security in Depth.

..and heartbeat-block will be ignored? ..or match as well?

only be matched with user florian, for rest of the users if there is no other rule to allow the rest of the users configured it will be blocked