Access roles allow the firewall administrator to configure Network access according to:

Computer or computer groups combined with network covers only machine and location identity, omitting user identity and remote access client context.

Users and user groups alone omit machine identity and network location, which are also configurable dimensions within an Access Role.

Access Roles in Check Point SmartConsole aggregate user and user group identity, machine and machine group identity, network location, and remote access client type into a single reusable object. Using all of these dimensions together gives administrators the most granular and accurate access control possible in the Rule Base.

Remote access clients represent only one of the four dimensions of an Access Role and cannot enforce policy on internal users or machines by themselves.