Non AD user using internet.

Dear Community,
I am facing an issue with NGAF as i have configured the NGAF at HQ and at branch site and connected them with sangfor VPN. the primary AD server is at HQ and the secondary is at branch but both server are in sync. I configured the SSO through scripting and Domain controller based also. The Non AD user can see the POP-UP that SANGFOR SSO is configured . and NON AD user are not Allow to use the internet. but yet they are able to use the internet. and as i diagnose the issue i saw the NON AD user is using internet through VPN HQ NGAF because i just only configured the SSO only at branch site first. there is no tunnel route in the VPN. why my ANY User are using VPN tunnel for internet. this tunnel should be use for the private network only? any idea or sugegstion?

A VPN hides your IP address, and therefore, your real location. When you use a VPN, your internet traffic is rerouted through an encrypted virtual tunnel

i think answer by @CTI_JianJie is most reliable

Dear User,
Thank you for all your response. As we further diagnose the issue. checked the policy multiple time. there is no tunnel route in the VPN. The non authenticated user were able to use internet because in authenication sso tab advance option has a check that allow user to a have access the DNS server before authentication. that was checked when we unchecked it the issue was resolved. thank you all for the response. it help us to diagnose the issue.

Thank you

Hi, there is only one option in the Sangfor VPN to achieve the branch user's access internet via the HQ firewall.

When the Sangfor VPN tunnel route "enabled access internet via destination route user", else it will not route other traffic to the VPN tunnel.

Please do check on the setting above, if the issue is not working as expected, we suggest sending an email to tech.support@sangfor.com for us to assist on the problem.

Very nice topic and very good question, because no non ad user have to privilege's to use the VPN tunnel as it is related to our organization security. First of all, look at your policy, it might not be working or implemented yet. Second thing, segment your network which is very necessary in this case. The guest users/non ad users should be on different network and not on the same network so in this way that traffic can be controlled.

Please double check your policies

You need to double check your VPN policy.

Please rescan your policy, maybe there were some misconfig

Recheck the policy

Review your polices.