At a regional insurance office, paralegals and claims adjusters share three DHCP subnets, but only members of the Paralegals directory group may open the client-file share, while adjusters on the same addresses must be blocked. Contractor laptops in the guest VLAN never sign in to the directory yet must reach the internet, and the policy's default action blocks everything else. How should the user-to-IP mapping and network matching be arranged for these two groups?
Select an answer to reveal the explanation.
Short Explanation
You're covering two different populations, and each one needs its own matching method. A user condition rides on user-to-IP mapping, so the rule follows the paralegal group instead of a subnet, while a subnet rule keeps the account-less guest VLAN moving. Directory logins are your address book, and the guest VLAN simply isn't in it.
Full Explanation
A rule can only match what the appliance can see, and a user condition needs a user-to-IP mapping produced by an identity source (for example an identity policy using ISE, Terminal Services Agent or captive portal) working with the directory realm, which supplies the users and groups. Attaching that condition to the share rule lets the management center resolve each address to a known account when the flow is evaluated, so group membership decides the outcome even though adjusters hold addresses from the same DHCP pools. Address-only matching fails conceptually because a subnet object is a network fact rather than an identity, so everyone in those ranges matches and the restriction to paralegals disappears. Logging-only matching fails because usernames in connection events are reporting rather than enforcement, and the rule still admits anyone in the range. Folding the guest VLAN into the user-condition rule fails because contractors never authenticate to the directory, so they never produce a mapping and the default block action stops them. Exam caveat: mappings age out after inactivity, so confirm your identity source observes every client you rely on. Practical check: connect as a paralegal and as an adjuster from the same address and compare the usernames in the connection events.