any

—Includes packets regardless of the source user.

pre-logon

—Includes packets from remote users that are connected to the network using GlobalProtect, but are not logged into their system. When

pre-logon

is configured on the Portal for GlobalProtect clients, any user who is not currently logged into their machine will be identified with the username pre-logon. You can then create policies for pre-logon users and although the user is not directly logged in, their machines are authenticated on the domain as if they were fully logged in.

known-user

—Includes all authenticated users, which means any IP address with user data mapped. This option is equivalent to the “domain users” group on a domain.

unknown

—Includes all unauthenticated users, which means IP addresses that are not mapped to a user. For example, you could use

unknown

for guest level access to something because they will have an IP address on your network, but will not be authenticated to the domain and will not have IP address-to-username mapping information on the firewall.

Select

—Includes users specified in this window. For example, you can select one user, a list of individuals, some groups, or manually add users.