IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Restrict access to a reverse proxy protected resource from external DMZ network

  • 1.  Restrict access to a reverse proxy protected resource from external DMZ network

    Posted Mon December 30, 2019 01:18 PM
    Hi,
    I need to restrict access to a reverse proxy protected resource from external DMZ network, user only should have access to that resource from external DMZ network if user belongs to an ISAM group.
    I have tried Risk Profiles and Access Control from Secure Access Control module without success. Does anybody know if I can do it implementing infomap authenticacion policy? or if I have another option to get the goal?
    Any help would be apretiated.
    Thanks in advance.
    Greetings.

    ------------------------------
    David Vicenteño
    ------------------------------


  • 2.  RE: Restrict access to a reverse proxy protected resource from external DMZ network
    Best Answer

    Posted Tue December 31, 2019 06:57 AM
    Hello David,

    To have logic based on a combination of IP address and group membership you will need an Advanced Access Control authorization policy.

    A policy like this should give what you want:

    In this case, if the client IP matches 172.18.0.* and the user is not in the iv-admin group then they will be denied access.
    All other access is allowed.

    If the IP range in your external DMZ is more complex then you may require multiple statements to capture all the subnets. You could also add JavaScript PIP which would get client IP and return a boolean on whether it is in External DMZ or not.

    You will need to create a resource representing the top level of the resources you want to protect - and then attach the policy to it.  You should probably enable decision caching for the object because you only need to run the policy once per session (assuming client IP doesn't change within the session).   Remember that you'll need to publish the policy before it becomes active.

    Jon.


    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 3.  RE: Restrict access to a reverse proxy protected resource from external DMZ network

    Posted Thu January 02, 2020 11:48 AM
    Thank you very much Jon, your answer helps me a lot, Greetings.

    ------------------------------
    David Vicenteño
    ------------------------------

    Original Message


Related Content