Using location awareness with groups

Article:HOWTO26994  |  Created: 2010-01-08  |  Updated: 2010-01-15  |  Article URL http://www.symantec.com/docs/HOWTO26994
Article Type
How To


Environment


Using location awareness with groups

Employees frequently need to connect to the network from multiple locations, such as their homes, Internet cafés, hotels, and the office. Different locations may have different security needs.

You can create locations and assign a separate security policy to different locations based on the following criteria:

  • The type of network connection, such as wireless, Ethernet, or VPN.

  • The location of the connection.

You may want to add several locations that reflect the following kinds of connections:

  • Wireless connections inside the office.

  • Non-wireless connections inside the office.

  • Connections from remote corporate locations outside of the office.

  • VPN connections from outside of the office.

You add locations after you have set up all the groups that you need to manage. Each group can have different locations if your security strategy requires it. In the Symantec Endpoint Protection Manager console, you can set up the conditions that trigger automatic policy switching based on location. When you enable location awareness, it automatically applies the best security policy to a client or server, based on the location from which a user connects.

You can add a set of conditions to each group's locations that automatically selects the correct security policies for a user's environment. These conditions are based on criteria such as the network settings of the computer from which the request for network access was initiated. An IP address, a MAC address, or the address of a directory server can also function as condition. If you change a security policy in the console, either the management server updates the policy on the client or the client downloads the policy.

If the current location is not valid after the update, then the client either:

  • Switches to another location that is valid.

  • Uses the default location.

You can customize the policy and settings of each location. For example, the policies for an office location may not need to be as strict as the policies for a VPN or home location. The policy that is associated with the default location is used when the user is already behind a corporate firewall.

When you create a location, it applies to the group for which you created it and any groups that inherit from the parent group. You should create the locations that you intend to apply to all clients at the My Company group level. You can create some locations that are specific to a particular group. For example, in most companies all clients require a default location that is added automatically to the My Company group. However, not all clients require a VPN connection. You can set up a separate group that is called Telecommuters for the clients who require a VPN connection. You add the VPN location to the Telecommuters group as well as to the inherited office location. Clients in that group can then use the policies that are associated with either the office or the VPN location.

Table: Location awareness tasks that you can perform

Tasks

Description

Plan locations

You should consider the different types of security policies that you need in your environment to determine the locations that you should use. You can then determine the criteria to use to define each location.

See About planning locations.

Enable location awareness

To control the policies that are assigned to clients contingent on the location from which the clients connect, you can enable location awareness.

See Enabling location awareness for a client.

Add locations

You can add locations to groups.

See Adding a location with a wizard.

See Adding a location without a wizard.

Assign default locations

All groups must have a default location. When you install the console, there is only one location, called Default. When you create a new group, its default location is always Default. You can change the default location later after you add other locations.

The default location is used if one of the following cases occurs:

  • One of the multiple locations meets location criteria and the last location does not meet location criteria.

  • You use location awareness and no locations meet the criteria.

  • The location is renamed or changed in the policy. The client reverts to the default location when it receives the new policy.

See Changing a default location.

Configure communications settings for locations

You can also configure the communication settings between a management server and the client on a location basis.

See Configuring communication settings for a location.

Edit location properties

You can edit some location properties.

See Editing the name and description of a group's location.

Delete locations

You can delete any locations that are obsolete or no longer useful in your network.

See Deleting a group's location.



Legacy ID



349352


Article URL http://www.symantec.com/docs/HOWTO26994


Terms of use for this information are found in Legal Notices