A route domain is a BIG-IP® system object that represents a
particular network configuration. Route domains provide the capability to segment network
traffic, and define separate routing paths for different network objects and applications. You
can create an access policy that assigns users to different route domains using the Route Domain
and SNAT Selection action based on whatever criteria you determine appropriate.
You might use policy routing in a situation such as this: your company has switched from RADIUS
authentication to Active Directory authentication, but has not yet completed the full transition.
Because of the state of the authentication changeover, you would like your legacy RADIUS users to
pass through to a portal access connection on a separate router, instead of allowing full access
to your network.
This implementation provides configuration steps for this example.
Task summary
Configuring policy routing
To follow the steps in this example, you must have Access Policy
Manager® AAA server objects created for Active Directory and RADIUS as well.
You configure an access policy similar to this one to route users depending on
whether they pass Active Directory authentication or RADIUS authentication. This example
illustrates one way to handle a company-wide transition between one type of
authentication and another, and to ensure that users get access to the correct
resources, however they authenticate.
-
On the Main tab, click .
The Access Profiles List screen opens.
-
Click the name of the access profile for which you want to edit the access
policy.
The properties screen opens for the profile you want to
edit.
-
On the menu bar, click Access Policy.
The Access Policy screen opens.
-
In the General Properties area, click the Edit Access Policy for
Profile profile_name
link.
The visual policy editor opens the access policy in a separate
screen.
-
On an access policy branch, click the (+) icon to add an
item to the access policy.
A popup screen displays actions on tabs, such as General Purpose and
Authentication, and provides a search field.
-
On the Logon tab, select Logon Page and click the
Add Item button.
The Logon Page Agent properties screen opens.
-
Make any changes that you require to the logon page properties and click
Save.
The properties screen closes and the visual policy editor
displays.
-
On the fallback branch after the previous action, click the
(+) icon to add an item to the access policy.
A popup screen opens.
-
On the Authentication tab, select AD Auth.
A properties screen displays.
-
From the Server list, select a server.
-
Click Save.
The properties screen closes and the visual policy editor
displays.
-
On the Successful branch after the previous action, click the
(+) icon.
A popup screen opens.
-
Assign resources to the users that successfully authenticated with Active
Directory.
-
On the Assignment tab, select the Advanced Resource
Assign agent, and click Add
Item.
The Resource Assignment window opens.
-
Click Add new entry.
An Empty entry displays.
-
Click the Add/Delete link below the entry.
The screen changes to display resources on multiple
tabs.
-
On the Network Access tab, select a network access resource.
-
Optional:
Optionally, on the Webtop tab, select a network access webtop.
-
Click Update.
The popup screen closes.
-
Click Save.
The properties screen closes and the visual policy editor
displays.
-
Click the ending that follows the Advanced Resource Assign action and
change it to an allow ending, by selecting Allow
and clicking Save.
-
On the fallback branch after the Active Directory action, click the
(+) icon to add an item to the access policy.
In this case, fallback indicates failure. For users that did not pass Active
Directory authentication, you can configure RADIUS authentication and select a
route domain for them so that they go to a different gateway.
A popup screen opens.
-
Type radi in the search field, select RADIUS
Auth from the results, and click Add
Item.
A popup screen opens.
-
From the AAA Server list, select a RADIUS server and
click Save.
The popup screen closes and the visual policy editor
displays.
-
On the Successful branch after the previous action, click the
(+) icon.
A popup screen opens.
-
On the Assignment tab, select Route Domain and SNAT
Selection and click the Add Item
button.
This opens the popup screen for the action.
-
From the Route Domain list, select a route domain and click
Save.
The popup screen closes and the visual policy editor
displays.
-
On the successful branch after the route domain selection action, click the
(+) icon.
A popup screen opens.
-
Assign resources to the users that successfully authenticated with
RADIUS.
-
On the Assignment tab, select the Advanced Resource
Assign agent, and click Add
Item.
The Resource Assignment window opens.
-
Click Add new entry.
An Empty entry displays.
-
Click the Add/Delete link below the entry.
The screen changes to display resources on multiple
tabs.
-
On the Network Access tab, select a network access resource.
Note that you can assign the same network access resource to clients
whether they authenticate with Active Directory or RADIUS. You assigned
a different route domain to the clients that successfully authenticated
with RADIUS. As a result, both types of clients will reach separate
routers.
-
Optional:
Optionally, on the Webtop tab, select a network access webtop.
-
Click Update.
The popup screen closes.
-
Click Save.
The properties screen closes and the visual policy editor
displays.
-
Click the ending that follows the Advanced Resource Assign action and
change it to an allow ending, by selecting Allow
and clicking Save.
-
Click the Apply Access Policy link to apply and activate
the changes to the access policy.
To apply this access policy to network
traffic, add the access profile to a virtual server.
Note: To ensure that logging is configured to meet your
requirements, verify the log settings for the access profile.
