Continuation. The beginning can be viewed at this link SACG authentication
The SACG authentication process is as follows:
The SACG sends a message to the controller, requesting the synchronization of the rules of the pre-authentication domain, and post-authentication domain, and converts the obtained rules into ACLS. After the administrator configures the switch, firewall interfaces, and firewall security policies, the firewall sends a connection request to the controller periodically (at an interval of 10 minutes). Therefore, the administrator needs to configure the firewall to allow the local security zone (firewall itself) to access the security zone of the controller.
After the connection is established, the controller delivers the rules of the configured pre-authentication domain, and post-authentication domain to the firewall.
An end user enters the user name and password on the AnyOffice or another client to initiate an identity authentication request.
If the end user does not install the AnyOffice, the SACG pushes the URL (of a web or WebAgent page) configured on the firewall to the end user so that the end user can be authenticated through the web page.
The controller returns the authentication result. If the authentication fails, the end user can access only resources in the pre-authentication domain.
The SACG Switches the terminal's IP address to the corresponding domain and returns the execution result to the controller.
The controller compares the policy on the server with the local policy. If the policies are different, the controller delivers the latest security policy to the client. If the policies are the same, the controller does not perform the policy delivery operation but returns a response packet to the client.
The end user assesses the network. When a packet from the terminal passes through the SACG, the SACG uses the ACL of the corresponding authentication domain to limit the network resources that the end user can access.
continuing the theme SACG Application Scenario
If you are interested in this topic and want to read the continuation, like and write in the comments.
