Configure a service access object

This task enables you to configure a service access object, which defines the conditions that traffic must meet to access a service, such as remote access VPN on the Firewall Threat Defense device.

Service access objects allow you to manage access based on geolocations and ensure that only traffic from approved regions can access specified services.

A service access object defines conditions as multiple rules to be executed in order. Each service access rule has an Allow or Deny action and a set of match criteria such as country, continent, or user-defined geolocation objects.

These rules are used to manage access to services, such as remote access VPN, and enforce security policies based on the source location of the traffic. If the traffic does not match any rules, the default action is enforced.

Use this task when you need to enforce or restrict access based on geographic or custom geolocation objects.

Before you begin

Procedure

Step 1

Choose Objects > Access List > Service Access.

Step 2

Click Add Service Access Object to create a new object.

Step 3

In the Add Service Access Object dialog box, configure the following parameters:

  1. In the Name field, enter a name for the object.

  2. Click Add Rule to add a rule for the service access object. In the Add Service Access Rule dialog box, configure the following parameters:

    1. Choose an action as Allow or Deny from the drop-down list.

    2. From Available Countries, select countries, continents, or user-defined geolocation objects and move them to the Selected Geolocation list.

    3. Click Add.

    After you create a service access rule, a sequence number is assigned to the rule. This number determines the execution order of the rule. You cannot reorder these rules.

Step 4

From the Default Action drop-down list, choose Allow All Countries or Deny All Countries.

Step 5

(Optional) Check the Allow Overrides check box and click + to configure overrides for the service access object for devices.

Note

When you define an override for a device or a domain, whenever the system configures this object on the device or domain, it uses the override value instead of the value defined in the original object.

Step 6

(Optional) In the Add Service Access Override dialog box, configure these parameters:

  1. From the Target Devices and Domains drop-down list, choose the required devices or domains for the override.

  2. Verify if you require the existing rules. Otherwise, delete them.

  3. Click Add Rule to create service access rules for this object override.

    1. Choose an action as Allow or Deny from the drop-down list.

    2. From Available Countries, select countries, continents, or user-defined geolocation objects and move them to the Selected Geolocation list.

    3. Click Add.

  4. From the Default Action drop-down list, choose Allow All Countries or Deny All Countries.

  5. Click Add.

Step 7

Click Save.

What to do next

Configure the Service Access object in the remote access VPN policy. For more information, see Configure Access Interfaces for Remote Access VPN.