Quick Overview

IP Groups in zAccess allow administrators to group endpoint devices based on their IP addresses. These groups serve as identity containers that can be referenced in rulesets to apply specific policies depending on the network from which a device connects. This is particularly useful in distinguishing trusted internal networks from external or guest networks.

How to Use This Feature in the UI

1. Navigate to Policy Configuration > IP Groups.
2. Click ADD GROUP.
3. Enter a descriptive Group Name (e.g., “HQ Subnet” or “Remote VPN Clients”).
4. Input one or more IP addresses or CIDR notations (e.g., 192.168.10.25 or 10.0.0.0/24).
5. Click Save to create the group.

Concepts & Use Cases

• Location-Aware Access Control: Assign different access policies to devices based on their originating IP addresses or subnets.
• Internal vs. External Differentiation: Restrict sensitive applications to internal IP ranges while applying stricter controls to external clients.
• Multi-Site Network Management: Assign different IP groups to different branches or regions and align them with localized gateway policies.
• Segmentation Enforcement: Combine IP groups with subnet definitions to enforce logical network segmentation.

Troubleshooting & FAQs

• Why isn’t my IP group matching a device?
  Verify that the device is connected to the expected network and that its IP falls within the configured range or CIDR block.
• Can I use IPv6 addresses in IP Groups?
  Yes, zAccess supports IPv6 entries in IP groups where applicable.
• How can I verify a match?
  Use the Endpoint Sessions view to confirm group associations based on observed IP addresses.
• What happens if a device belongs to multiple IP groups?
  All applicable groups are considered during ruleset evaluation. Final policy selection is based on the first matching ruleset.