Default Policy under IAG Authentication Policy

What does the Default Policy under IAG Authentication Policy (under Web Authenticaiton) mean (i.e. the expected behaviour) ?

Screen captures of the default policy for Web authentication

Hi Dear

The Default Policy under IAG Authentication Policy (Web Authentication) typically serves as a fallback or catch-all policy for users who don't match specific authentication rules. Here's what you can expect:

Expected Behavior
1. *Authentication requirements*: The Default Policy defines the authentication requirements for users who don't match other policies.
2. *Authentication methods*: It specifies the authentication methods allowed or required, such as username/password, multi-factor authentication (MFA), or others.
3. *Access control*: The policy may also define access controls, such as allowed IP addresses, user groups, or other conditions.

Implications
1. *Fallback policy*: The Default Policy acts as a fallback for users who don't match other, more specific policies.
2. *Security implications*: A lenient Default Policy might allow unauthorized access, while a strict policy might block legitimate users.
3. *Configuration*: Carefully configure the Default Policy to balance security and accessibility needs.

Best Practices
1. *Clearly define policy requirements*: Ensure the Default Policy is well-defined and aligns with organizational security requirements.
2. *Regularly review and update policies*: Periodically review and update the Default Policy to ensure it remains effective and aligned with changing security needs.

If you have specific questions about configuring or managing Default Policies in your IAG setup, feel free to ask!

HiHi,

In Sangfor IAG's Web Authentication default policy:

IP: 0.0.0.0-255.255.255.255: This range encompasses the entire IPv4 address space. 0.0.0.0 is the network address, and 255.255.255.255 is the broadcast address. Specifying this range ensures that the policy applies to any device connecting via IPv4.

MAC address: ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff: This is a similar wildcard for MAC addresses. It's a hexadecimal representation that covers all possible 48-bit MAC addresses. Therefore, the policy will apply regardless of the device's physical MAC address.

Essentially, these default settings mean that the Web Authentication policy applies to all devices connecting to the network through the IAG, without considering their IP or MAC addresses. This general approach is often used initially until more specific access controls are set up. Once you establish specific rules, you may want to replace these basic entries with exact IP ranges or MAC addresses to strengthen your authentication policy.