If an administrator wants to restrict access to a network resource only allowing certain users...

Create an inline layer where the destination is the target network resource Define sub-rules allowing only specific sources to access the target resource

Use a "New Legacy User at Location", specifying the LDAP user group that the users belong to, at the desired location

Create a rule allowing only specific source IP addresses access to the target network resource.

Create an Access Role object, with specific users or user groups specified, and specific networks defined Use this access role as the "Source" of an Access Control rule