Is it possible to apply a firewall rule or policy to "people"?

Hello Ace,

Thank you for contacting the Sophos Community!

To be able to see the users in the Firewall, you will need to authenticate them to the XG so the XG know who the user is.

The XG has different type of authentication methods, for example:

Sophos XG Firewall: Client Authentication Agent

STAS

Captive Portal

I think it would depend on what type of authentication is available for users in the company, if you also use Endpoint, you could authenticate users based on heartbeat.

But once the user authenticates against the XG you can select the Match Known Users in the XG, and select to which groups or users this firewall rule will apply to.

Regards,

Hello Ace,

Thank you for contacting the Sophos Community!

To be able to see the users in the Firewall, you will need to authenticate them to the XG so the XG know who the user is.

The XG has different type of authentication methods, for example:

Sophos XG Firewall: Client Authentication Agent

STAS

Captive Portal

I think it would depend on what type of authentication is available for users in the company, if you also use Endpoint, you could authenticate users based on heartbeat.

But once the user authenticates against the XG you can select the Match Known Users in the XG, and select to which groups or users this firewall rule will apply to.

Regards,

Okay.

Some of our customers do use both an XG Firewall and endpoint protection. Within our own organization we use an XG Firewall and our workstations have Sophos Endpoint protection. There is no Active Directory, we're a small company so it's not necessary. I am setup as a "person" in the central portal and I have my laptop associated with me as a device.

We are using Heartbeat and I recently added the LAN Zone to the missing heartbeats config, but I'm not sure how/when "people" come into play or how to get them to show up as known users

I do see that it's finding the endpoints though...

Can you shed any further light on this?

Hello Ace,

Thank you for the follow-up!

Unfortunately, the heartbeat authentication only works with AD, since it will share domain user account information from the client machine the user is logged into with the firewall via Heartbeat. The Firewall will then check the user account against the configured AD server and activates the user.

In your case you would need to use either CAA or the Captive Portal, you would need to create local users in the XG by following this KBO

Once each user has a username and password, you can follow the KB for CAA or Captive Portal.

This other KB will explain more about options for creating user-based firewall rules.

Regards,

Okay, thank you for helping me understand. I appreciate it!