Creating and Applying Group Policies

Available Options

The following table describes the rules, restrictions, and other settings that can be controlled via group policy on each platform. Only features that are available for the network will be displayed when configuring a group policy.

Creating a Group Policy

1. Navigate to Network-wide > Configure > Group policies.
2. Click Add a group to create a new policy.
   
3. Provide a Name for the group policy. Generally, this will describe its purpose or the users it will be applied to.
   Ex. "Guests," "Throttled users," "Executives," etc.
4. Modify the available options as desired. Unless changed, all options will use the existing network settings.
5. When done, click Save Changes.

The group policy listed will now be displayed on the Group policies page and made available for use. Remember that a group policy has no effect until it is applied.

Example Group Policies

The following examples outline two common use cases and how group policies can be used to provide a custom network experience.

By Client

Group policies can be manually applied to clients from the Network-wide > Monitor > Clients page.

1. Check the box next to the desired client(s) in the list.
2. Click the Policy button at the top of the list.
3. Select Group policy and then choose the specific policy in the drop-down.
4. Click Apply policy.

Alternatively, on wireless and combined networks, different group policies can be applied depending on the SSID the client is associated to. This is applied from the same page as the previous steps.

1. Check the box next to the desired client(s) in the list.
2. Click the Policy button at the top of the list.
3. Select Different policies by [connection or] SSID.
4. For each SSID, select the desired group policy, built-in policy, or leave as normal.
5. Click Apply policy.

Policies can also be applied to individual clients by clicking on the client in the clients list and then choosing a Device policy under the Policy section.

By Device Type

In wireless networks, group policies can be automatically applied to devices by type when they first connect to an SSID and make an HTTP request. 

1. Navigate to Wireless > Configure > Access control.
2. Select the desired SSID.
3. Set Assign group policies by device type to "Enabled."
4. Click Add group policy for a device type.
5. Select the desired Device type and the Group policy that should be applied to it. 
6. Repeat steps 4-5 as needed to assign policies to all desired devices.
7. Click Save changes.

Keep in mind that this only occurs when a device first connects to the SSID and persists until it is manually overridden. Thus, some previously connected clients may need to have policies manually assigned. It is also possible for a client to be misclassified based on the initial HTTP request, depending on how it is generated by the device. If this occurs, manually assign the desired policy.

Please refer to the documentation for more information on applying group policies by device type.

By VLAN

On security appliance networks, group policies can be automatically applied to all devices that connect to a particular VLAN. From the Security & SD-WAN > Configure > Addressing & VLANs page:

1. Ensure that VLANs is "Enabled."
2. Click on the desired Local VLAN.
3. Select the desired Group policy.
   
    
4. Click Update.
5. Click Save Changes.

Any clients that are placed in this VLAN will now be given the desired Group policy.

By Active Directory Group

Security appliance networks with Advanced Security licensing can use Active Directory groups to assign policies to clients. Refer to the article on configuring AD-based group policy for more information.

By RADIUS Attribute

Wireless networks that are using RADIUS to authenticate clients can be configured to assign group policies via RADIUS attributes. Refer to the article on configuring group policies with RADIUS attributes for more information.

By Identity PSK (IPSK)

Identity PSK or IPSK comes in two variants, IPSK with RADIUS and IPSK without RADIUS. Identity PSK with RADIUS authentication acts as a standard WPA2 PSK SSID to clients, while authenticating clients to a central server based on their MAC address. IPSK without RADIUS allows a network administrator to use multiple PSKs per SSID without the use of a RADIUS server. Further, the feature allows you to assign group policies in the dashboard based on the PSK used by the client device to authenticate to the Wi-Fi network. Please refer to the article IPSK with RADIUS Authentication and/or IPSK Authentication without RADIUS.