Match Identity for network protection over SSL VPN

Question

Hello I would like to know if it is possibile to setup policy network to match Identity of the user connected through SSL VPN to permit only specifi service and not the whole remote network nor fullservice on remote server

This thread was automatically locked due to age.

sachingurung · Accepted Answer

Hi, 
 Good question. 
 Yes you can define specific Services to SSL VPN Users. 
 To permit particular network Host over SSL VPN, you need to configure the Source IP in Permitted Network Resources (IPv4). 
 To do this, navigate through options: 
 
 System 
 VPN 
 SSL VPN (Remote Access) 
 Tunnel Access 
 Permitted Network Resources (IPv4)

To allow specific Services over SSL VPN, you have to create two Firewall Rule(s): 
 1. LAN-VPN ( MASQ disable) - Services Specified 
 2. VPN-LAN ( MASQ Applied ) - Services Specified 
 
 Through this configurations, services that are explicitly defined in the Rule will be allowed. 
 Hope that helps.

sachingurung · Answer

Good question. 
 When you connect to SSL VPN, you authenticate as a User already present in XG. If full tunnel mode is used, XG will see the User identity and provide him the customized access as per the configurations. 
 So yes, layer 8 functionality will be applicable, as XG will see the SSL VPN connected user as a Live User. 
 Thanks 
 Sachin Gurung