We have the need to set up a multiple rule Host Checking rule that looks for a machine certificate as well as for a value within that Certificate.
The idea is that a certain small group of users will receive the same machine certificate that everyone else gets, however it will have an added value in that cert. Then - if this value is detected, that users host checking would FAIL. Thus we limit this certain small group of users from the same access as the greater body of our users.
This is the rule: Machine_Cert NOT Machine_Cert_Value_Partner
I figured a NOT rule would work (ie. You have the machine certificate installed but NOT a certain value within the cert: therefore your Host Checking passes).
Juniper's 6.5 Admin guide seems to present that NOT rules are viable (page 298).
This is the error text we see when trying to saving the rule: Syntax error on line 1, character 1Machine_Cert NOT Machine_Cert_Value_Partner
We have tried '!' as well as 'NOT'. Using AND as well as OR rules are not causing issues...
Are we missing something?
Thanks!
