Your status is very hard.

Make a policy that NON AD Group will be block.

Review your polices.

Recheck the policy

Please rescan your policy, maybe there were some misconfig

You need to double check your VPN policy.

Please double check your policies

Very nice topic and very good question, because no non ad user have to privilege's to use the VPN tunnel as it is related to our organization security. First of all, look at your policy, it might not be working or implemented yet. Second thing, segment your network which is very necessary in this case. The guest users/non ad users should be on different network and not on the same network so in this way that traffic can be controlled.

Hi, there is only one option in the Sangfor VPN to achieve the branch user's access internet via the HQ firewall.

When the Sangfor VPN tunnel route "enabled access internet via destination route user", else it will not route other traffic to the VPN tunnel.

Please do check on the setting above, if the issue is not working as expected, we suggest sending an email to tech.support@sangfor.com for us to assist on the problem.

Dear User,
Thank you for all your response. As we further diagnose the issue. checked the policy multiple time. there is no tunnel route in the VPN. The non authenticated user were able to use internet because in authenication sso tab advance option has a check that allow user to a have access the DNS server before authentication. that was checked when we unchecked it the issue was resolved. thank you all for the response. it help us to diagnose the issue.

Thank you