Scenario 3: Employees Connecting from a Public Kiosk

This scenario begins with an employee connecting to the appliance from a public kiosk:

From 12.4.2 onwards, Cache Cleaner functionality is no longer supported in mac or windows platforms.

1. The user connects to the appliance, logs in to the realm Employees, and is assigned to the Full-time employees community.
2. After the user authenticates, the client device is interrogated to determine if it matches any device profiles belonging to zones referenced by the Full-time employees community, starting with any Deny zones and proceeding through the others listed for the community.

3. In this scenario, the appliance finds that the client doesn’t match any of the configured device profiles. There are a couple of ways to handle this sort situation: classify the client into a Quarantine zone, or into the Default zone. In this example, the Quarantine zone Untrusted is used. The only resources a user has access to are those that you have set up: you might, for example, display a customized page with links to Web resources for bringing a system into compliance with your security policies.

   1. If the untrusted device (for example, a PC in a public kiosk) is running Windows 10, Windows Vista, or Windows 2008 Server, and a supported browser, the user is required to download and install the client component manager, Secure Endpoint Manager. The client component manager automatically deploys Cache Cleaner for the user. The appliance then provisions the access agent configured for the Full-time employees community, and the user can access the appropriate network resources.

   2. If the device’s operating system and browser are not compatible with Cache Cleaner, a message is displayed.

   3. If Cache Cleaner cannot be deployed on the client, the user’s connection request is denied.

   See Configuring the Default Zone for information on the setup options for this zone.