Users and Ip ranges for filtering, either or?

[Mathiau]

I have a situation in the office, we have 8 Windows 7 boxes and 1 Mac in marketing. We had the Mac's on the domain but too many problems with Lion dropping the accounts so i said forget it, go back to just normal user accounts.

now with that,. i have marketing on their own rack, and it tracks by users, i wanted to know can i track by either IP or User?

so i have my users selected but if i also enter in say 10.0.0.1 in the IP, will the policy match either one it matches first? so it will catch the MAC, and everyone will be tagged by the user account?

[dmorris]

I'm not sure I understand the question.

The rules are evaluated in order for each new session. The first matching rule is the policy that is given.

If you have
rule 1: ClientIP 1.2.3.4 -> FooRack
rule 2: user bob -> FooRack
rule 3: * -> Default Rack

The all 1.2.3.4 traffic and traffic from any machine that bob is logged into goto "FooRack" and everything else goes to Default Rack.

[Mathiau]

just redoing my racks now, once i get one set up i will post the screen shot of a config.

[Mathiau]

attached is a screen shot of the Policy screen.

Now in this example, i have some servers using IPs that range from 10.0.1.2 to 10.0.1.30

See PolicyIPOnly.jpg

But, i also have some domain accounts i use to log into servers specifically.

So i was curious, if i also add those users under the "Users:" portion of the policy,

So the Policy has both IP range and users in it, how would that work?

Does policy manager on a individual policy check in order, so first it would match the IP and if not check the User?

Or does it look to match both user and ip?