User's Manual

UTT Technologies C hapter 8 User Management
http://www.uttglobal.com Page 138
8.2.3 Execution Order of Group Management Policies
If a user’s computer belongs to more than one group, in other words, if the user matches
more than one group management policy, it will be subject to the first one added. More
specifically, after you configure some group management policies, the Wireless Router
will search the Group Management List to find out if there is a policy matching a user . It
will check the user’s IP address against each policy in the order in which the policies are
listed. The first matching policy will apply to the user. Note that the policies are listed in
chronological order of creation (i.e., most recent at the bottom).
8.2.4 Priorities of Global and Group Management
Policies and Access Rules
The access rules have higher priority than the group management policies, and the group
management policies have higher priority than the global management policy. That is,
when receiving a packet initiated from a local computer, the Wireless Router will first
check it against the access rules, next the group management policies, lastly the global
management policy. The first rule (or policy) that matches the packet is applied. After a
match is found, no further rules or policies are checked.
For example, if you have selected the Block M SN check box in the User > Global
Management page, added a group management policy which allows a group of users to
use MSN (Block MSN check box is cleared) in the User > Group Management page,
and added an access rule which denies all users access to the Internet in the Firewall >
Access Control page, then any users are unable to access the Internet because the
access rule is matched first. Now if you only delete the access rule, then the users belong
to the specified group can use MSN, but other users cannot.
8.2.5 An Example for Group Management Policy
1. Requirements
A business uses a AC750W Wireless Router to access the Internet. The CEO wants to
control Internet behaviors of the employees of the Administration Department and
Business Department:
1) Block the Administration Department’s employees (IP range: 192.168.1.2-
192.168.1.10) from using MSN and QQ, and allow them to access all other services.