Create an Identity Rule

For details about configuration options for identity rules, see Identity Rule Fields.

Before you begin

You must create and enable a realm or realm sequence.

Create a Microsoft Active Directory realm and realm directory as discussed in Create an LDAP Realm or an Active Directory Realm and Realm Directory.
(Microsoft AD realm only.) Download users and groups and enable the realm as discussed in Synchronize Users and Groups.
Create a Microsoft Azure AD (SAML) realm as discussed in Create a Microsoft Azure AD (SAML) Realm.
(Optional.) Create a realm sequence as discussed in Create a Realm Sequence.
Rules are evaluated top-down. For a connection that matches the specified network criteria of a given rule, the user is evaluated against the identity realm specified in the rule. If the user is not part of that realm, they will be marked as unknown, and no further rules in the identity policy will be evaluated. Thus, if you have more than one realm that needs to be evaluated, be sure to use realm sequences instead of a single realm.

Caution

Adding the first or removing the last active authentication rule when TLS/SSL decryption is disabled (that is, when the access control policy does not include a decryption policy) restarts the Snort process when you deploy configuration changes, temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the target device handles traffic. See Snort Restart Traffic Behavior for more information.

Note that an active authentication rule has either an Active Authentication rule action, or a Passive Authentication rule action with Use active authentication if passive or VPN identity cannot be established selected.

Procedure

Step 1	Log in to the management center.
Step 2	Click Policies > Access Control > Identity .
Step 3	Click Edit () next to the identity policy to which to add the identity rule. If View () appears instead, the configuration belongs to an ancestor domain, or you do not have permission to modify the configuration.
Step 4	Click Add Rule.
Step 5	Enter a Name.
Step 6	If the Specified rule is applicable, check the check box of Enabled.
Step 7	To add the rule to an existing category, indicate where you want to Insert the rule. To add a new category, click Add Category.
Step 8	Choose a rule Action from the list.
Step 9	If you're configuring captive portal, see How to Configure the Captive Portal for User Control.
Step 10	(Optional) To add conditions to the identity rule, see Identity Rule Conditions.
Step 11	Click Add.
Step 12	In the policy editor, set the rule position. Click and drag or use the right-click menu to cut and paste. Rules are numbered starting at 1. The system matches traffic to rules in top-down order by ascending rule number. The first rule that traffic matches is the rule that handles that traffic. Proper rule order reduces the resources required to process network traffic and prevents rule preemption.
Step 13	Click Save.

What to do next

Deploy configuration changes.