Explanation/Reference:
Explanation:
To create an access role:
1. Select Users and Administrators in the Objects Tree.
2. Right-click Access Roles > New Access Role.
The Access Role window opens.
3. Enter a Name and Comment (optional) for the access role.
4. In the Networks tab, select one of these:
Any network

Specific networks - Click the plus sign and select a network.

Your selection is shown in the Networks node in the Role Preview pane.
5. In the Users tab, select one of these:
Any user

All identified users - Includes users identified by a supported authentication method (internal users,

AD users or LDAP users).
Specific users - Click the plus sign.

A window opens. You can search for Active Directory entries or select them from the list.
6. In the Machines tab, select one of these:
Any machine

All identified machines - Includes machines identified by a supported authentication method (AD).

Specific machines - Click the plus sign.

You can search for AD entries or select them from the list.
7. Optional: For computers that use Full Identity Agents, from the Machines tab select Enforce IP spoofing protection.
8. Click OK.
The access role is added to the Users and Administrators tree.
Reference: https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/92705.htm