A route domain is a BIG-IP® system object that represents a
particular network configuration. Route domains provide the capability to segment network
traffic, and define separate routing paths for different network objects and applications. You
can create an access policy that assigns users to different route domains using the Route Domain
and SNAT Selection action based on whatever criteria you determine appropriate.
You might use policy routing in a situation such as this: your company has switched from RADIUS
authentication to Active Directory authentication, but has not yet completed the full transition.
Because of the state of the authentication changeover, you would like your legacy RADIUS users to
pass through to a portal access connection on a separate router, instead of allowing full access
to your network.
This implementation provides configuration steps for this example.
Task summary
Configuring policy
routing
To follow the steps in this example, you must have Access Policy Manager AAA server
objects created for Active Directory and RADIUS as well.
You configure an access policy similar to this one
to route users depending on whether they pass Active Directory authentication or RADIUS
authentication. This example illustrates one way to handle a company-wide transition
between one type of authentication and another, and to ensure that users get access to
the correct resources, however they authenticate.
-
On the Main tab, click .
The Access Profiles (Per-Session Policies) screen opens.
-
Click the name of the access profile for which you want to edit the access
policy.
The properties screen opens for the profile you want to
edit.
-
On the menu bar, click Access Policy.
-
In the General Properties area, click the Edit Access Policy for
Profile profile_name
link.
The visual policy editor opens the access policy in a separate
screen.
-
On a policy branch, click the (+) icon to add an item to
the policy.
A popup screen displays actions on tabs, such as General Purpose and
Authentication, and provides a search field.
-
On the Logon tab, select Logon Page and click the
Add Item button.
The Logon Page Agent properties screen opens.
-
Make any changes that you require to the logon page properties and click
Save.
The properties screen closes and the policy displays.
-
On the fallback branch after the previous action, click the
(+) icon to add an item to the policy.
A popup screen opens.
-
On the Authentication tab, select AD Auth.
A properties screen displays.
-
From the Server list, select a server.
-
Click Save.
The properties screen closes and the policy displays.
-
On the Successful branch after the previous action, click the
(+) icon.
A popup screen opens.
-
Assign resources to the users that successfully
authenticated with Active Directory.
-
On the Assignment tab, select the Advanced Resource
Assign agent, and then click Add
Item.
The Resource Assignment window opens.
-
Click Add new entry.
An Empty entry displays.
-
Click the Add/Delete link below the entry.
The screen changes to display resources on multiple
tabs.
-
On the Network Access tab, select a
network access resource.
-
Optional:
Optionally, on the Webtop tab, select a
network access webtop.
-
Click Update.
The popup screen closes.
-
Click Save.
The properties screen closes and the policy
displays.
-
Click the ending that follows the Advanced
Resource Assign action and change it to an allow ending, by selecting
Allow and
clicking Save.
-
On the fallback branch after the Active Directory
action, click the (+)
icon to add an item to the access policy.
In this case, fallback indicates failure.
For users that did not pass Active Directory authentication, you can configure
RADIUS authentication and select a route domain for them so that they go to a
different gateway.
A popup screen
opens.
-
Type radi in the search field, select RADIUS Auth from the results,
and click Add
Item.
A popup screen
opens.
-
From the AAA Server list, select a
RADIUS server and click Save.
The popup screen closes and
the visual policy editor displays.
-
On the Successful branch after the previous action, click the
(+) icon.
A popup screen opens.
-
On the Assignment tab, select Route Domain and SNAT
Selection and click the Add Item button.
This opens the popup screen
for the action.
-
From the Route Domain list, select a route domain
and click Save.
The popup screen closes and
the visual policy editor displays.
-
On the successful branch after the route domain
selection action, click the (+) icon.
A popup screen
opens.
-
Assign resources to the users that successfully
authenticated with RADIUS.
-
On the Assignment tab, select the Advanced Resource
Assign agent, and then click Add
Item.
The Resource Assignment window opens.
-
Click Add new entry.
An Empty entry displays.
-
Click the Add/Delete link below the entry.
The screen changes to display resources on multiple
tabs.
-
On the Network Access tab, select a
network access resource.
Note that you can assign the same
network access resource to clients whether they authenticate with Active
Directory or RADIUS. You assigned a different route domain to the
clients that successfully authenticated with RADIUS. As a result, both
types of clients will reach separate routers.
-
Optional:
Optionally, on the Webtop tab, select a
network access webtop.
-
Click Update.
The popup screen closes.
-
Click Save.
The properties screen closes and the policy
displays.
-
Click the ending that follows the Advanced
Resource Assign action and change it to an allow ending, by selecting
Allow and
clicking Save.
-
Click the Apply Access Policy link to apply and activate
the changes to the policy.
To apply this access policy to network
traffic, add the access profile to a virtual server.
Note: To ensure that logging is configured to meet your
requirements, verify the log settings for the access profile.
