tab to define
the source interface(s) or source zone(s), and optionally the source
address(es) and source user(s) that define the incoming traffic
to which the DoS policy rule applies.
Select the type of source to which the DoS
Protection policy rule applies:
the rule to traffic coming from the specified interface or group
—Apply the rule to traffic coming
from any interface in a specified zone.
select multiple interfaces or zones.
specify one or more source addresses to which the DoS Protection
policy rule applies.
specify that the rule applies to any addresses except those specified.
Specify one or more source users to which
the DoS Protection policy rule applies:
packets regardless of the source user.
—Includes packets from remote
users that are connected to the network using GlobalProtect, but
are not logged into their system. When
configured on the Portal for GlobalProtect clients, any user who
is not currently logged into their machine will be identified with
the username pre-logon. You can then create policies for pre-logon
users and although the user is not directly logged in, their machines
are authenticated on the domain as if they were fully logged in.
—Includes all authenticated
users, which means any IP address with user data mapped. This option
is equivalent to the “domain users” group on a domain.
—Includes all unauthenticated
users, which means IP addresses that are not mapped to a user. For
example, you could use
level access to something because they will have an IP address on
your network, but will not be authenticated to the domain and will
not have IP address-to-username mapping information on the firewall.
—Includes users specified in
this window. For example, you can select one user, a list of individuals,
some groups, or manually add users.
firewall collects user information from a RADIUS, TACACS+, or SAML
identity provider server and not from the User-ID™ agent, the list
of users does not display; you must enter user information manually.