NGAF issue

Hi,
I have NGAF, and I want only domain devices should access the internet and if any unknown domain device or guest device connect to internal network should not access the internet.
Kindly suggest how to achieve that.

Product Name & Version No.: M4500-F-I & version 8.0.47

Thank You

Hi,
To make sure that only those domain devices are allowed and can access the internet while blocking unauthorized devices on your SAngfor NGAF, you may try following these steps:
1.        Ensure that your LAN and WAN are configured correctly
2.        Try assigning the appropriate interfaces to the LAN and WAN zones by going to Network > Interfaces > Zone
3.        Setup access control policies to allow internet access to those domain devices only by navigating to Policies > Access Control > Application Control and use domain ndevice identifiers like IP ranges or specifying MAC addresses
4.        Make sure that only domain devices can access the network by going to Policies > Device Compliance and create compliance policies and bind it to the domain devices using MAC address or unique identifiers
5.        To ensure that only authenticated domain users can access the intern, enable user authentication by going to Policies > User Authentication and configure authentication method to verify domain users
6.        Monitor the network traffic and adjust the policies as required

Go to polices and enabtle the authentication policy

We already segregate all networks like management vlan 50, user vlan 10, server vlan 30 and guest 60. DHCP we configure on ngaf and SSO but due to logout issue and internet stop working once they connect back until they restart or logout/login  2-3 times. Currently I allowed whole network in policy instead of LDAP users. I will try domain isolation and other methods explain by other members. Most probably I will try next all these options.

you need to create a dedicated vlan on your netwrok environment for your domain users only.

For this, configure access control policies based on user authentication. Enable 802.1x authentication or integrate with your domain controller to enforce policies that only allow authenticated domain users to access the network. Any device not authenticated or recognized by the domain will be blocked from accessing the internet.

you can set authentication policy .

To achieve this on your Sangfor NGAF M4500-F-I v8.0.47, you can configure the "Domain Isolation" feature. This feature allows you to isolate specific domains to the internet, while denying access to unknown or guest devices. To do this, go to the NGAF web interface, navigate to "Policy" > "Domain Isolation", and create a new policy. Select the domain(s) you want to isolate and set the "Outbound Access" to "Allow". Then, create a new rule with a "Source" of "Unknown" and set the "Action" to "Deny". This will block any unknown devices from accessing the internet. Finally, make sure to enable the policy and apply it to your desired zones or interfaces. This way, only authorized domain devices will be able to access the internet, while unknown or guest devices will be blocked.