AD Connector / Policy manager??

[tracyprier]

Hi gang

I have been using UT for a while now in our company. I now have a need to allow certain groups access to sites we don't want others getting to i.e. marketing getting to youtube etc.

I am a little uncertain of what apps I need to do this, do I need Policy Manager, AD connector or both??

We run a server 2003 domain with AD.

Can I setup seperate groups (unconnected to AD) with Policy manager alone??

Appreciate input on this.

Thanks
Tracy

[sky-knight]

You need the policy manager to have multiple racks, and create your different security contexts.

You need the AD connector to be able to route traffic into the racks by user name.

No, you can't use groups... it has to be user.

Beyond that you can also route traffic into racks with CIDR style network ranges.

[Big D]

AD group support is on the roadmap but it don't work yet, yes it does show up but its just there to tease you.

AD connector functions by running a script that run in the background and updates UT IP mappings every 5 minutes I believe. This is usually done via a group policy object or script at login.

[tracyprier]

OK, so I only really need PM and I can just set up users within that. It will only be a handful of people so it doesn't sound like AD connector would be of any real benefit?

[gotkimchi]

if the users have their own PC, you can use just the policy manager. Make sure they have static IPs and create policies based on IPs. If the users share PCs and login from all over the network (different PCs), you might want to use the AD and the policy manager.

[tracyprier]

Originally Posted by gotkimchi

if the users have their own PC, you can use just the policy manager. Make sure they have static IPs and create policies based on IPs. If the users share PCs and login from all over the network (different PCs), you might want to use the AD and the policy manager.

Do you mean I would need to give every user a static IP or just the ones I wanted to redirect (i.e. the users in marketing)??

thanks
Tracy

[joemailey]

Originally Posted by tracyprier

Do you mean I would need to give every user a static IP or just the ones I wanted to redirect (i.e. the users in marketing)??

thanks
Tracy

Just the uses you want to redirect. providing they don't switch PCs.

[Wrencher]

Rather than create static IPs, I used DHCP reservations per another suggestion elsewhere in the forum, which has worked well here for website bypass. I then have OpenDNS protecting those users.

[JustinRocks]

tracyprier
Did you get this to work? If so How?
I want to allow a specific website to a specific user or IP

Thanks

[mdh]

JustinRocks,

Your issue is not as simple as it sounds to you. There is not one Facebook, because Facebook is too widely used. There are a large number of IP addresses that are assigned to Facebook, and your problem is not on the user end, its on the host end. You have to know all of the host IPs and make firewall rules, then keep checking on a regular basis to see if there are new hosts assigned to Facebook. That could be a full time job.