Access control lists

What access controls do

Access control settings prevent unauthorized access to the appliance and restrict authorized access to services. The appliance supports different types of rules that impose a variety of restrictions. Sets of rules, or access control lists (ACLs), are used to impose restrictions inside the intranet domain.

Internet setting

In an Internet setting, access controls can be used to set rules that limit access for authorized users.

Intranet setting:

In an intranet setting, access controls can help enforce authentication and authorize exactly what administrators have access to.

Authorized access

When a user makes an authenticated request, the appliance checks the user against all groups in the local user database, and attempts to match ACLs that are associated with those groups. If the request is not matched by user or group ACLs, then the request is checked against all other access control rules. If access is denied, a system message displays the rule and the name of the ACL that prevented access to services.

Controlling administrative access

ACLs can be applied explicitly to authorized users, but they are also effective for administering access control to individuals as part of a group, such as administrators. ACLs can be applied to members of administrative groups that are assigned "Admin, Full" and "Admin, Read-Only" access permissions.

ACL rule checking

The appliance sequentially reads ACLs and checks for the first matching entry. When a match occurs, the action is executed. If no match occurs, no action is executed and rule checking continues.

Rule checking sequence is shown in the following table.

Stage	Description
1	Check global settings that control authentication for protocol requests.
2	Check ACL permission settings for the applicable group in the local user database.
3	Check request-type (protocol specific) ACL.
4	Check Web accelerator ACL.
5	Check global ACL.
6	Check group permissions settings.
7	Allow the request.

Order of precedence

Types of rules and order of precedence are described in the following table.

Order	Type	Description
1	User and group	User and group rules explicitly allow, deny, or redirect requests. User and group ACLs have precedence over request-type, global, and group access permissions.
2	Request-type (protocol specific)	Request-type rules control specific types of traffic. Access control rules are processed only for requests of a particular type, or protocol, such as NFS. Request-type access controls have precedence over Global access controls. If a request-type rule explicitly allows, denies, or redirects a request, the appliance follows this rule regardless of any rules configured in the Global Access Control option and any content category restrictions set in the SmartFilter options.
3	Accelerator	If a request originates from a Web-accelerator (reverse-proxy), this ACL is checked.
4	Global	Global rules impose restrictions on all traffic by allowing you to specify variables, such as a user name and a URL.
5	Group access permissions	Group access permissions specify default access to services for groups, and control rewrites or redirects for blocked requests. Default rules apply to requests that have no rule matches.