Scenario 2: Applying uniform ACL rules over multiple appliances

Applying global ACL rules through multiple-cache management

The sample global multiple-cache configuration described in this section implements an ACL rule that enables, on a network-wide scale, some users to bypass the usual appliance authentication requirements because they are not in the database or because they are administrators.

Stage	Process
1	At ServerA the administrator creates a global configuration file, bypassauth.cfg, containing the following ACL command line: `config.acl.global = \\ allow client-ip 1.2.3.4 allow client-ip 1.7.12.123 allow client-ip 1.8.123.32 allow client-ip 1.9.132.38 allow client-ip 1.10.132.39 allow server-name 'intranet.company.com' try-auth any deny user paul allow auth deny any \\` This ACL command line setting enables some users, accessing the appliance from secured terminals, to bypass the usual appliance authentication requirements because they are not in the database or they are administrators. All others must authenticate unless they are accessing a few well-defined pages.
2	In the CLI console of ApplianceA, ApplianceB, ApplianceC, and ApplianceD, the administrator enters command lines to Specify the global configuration file to read: `set config.admin.config.list \\ default.cfg ftp://serverA//cfg/bypassauth.cfg local.cfg \\` Set up a periodic configuration refresh: `set config.admin.config.refresh.trigger periodic set config.admin.config.refresh.rate 1440`
3	As they have been configured in Stage 2, ApplianceA, ApplianceB, ApplianceC, and ApplianceD read the bypassauth.cfg file on ServerA every 24 hours (1440 minutes) and incorporate its settings into their active configurations.
4	Later, to modify the global ACL bypass authentication rules, the administrator logs into ServerA and modifies the `config.acl.globa`l option in the bypassauth.cfg file.: `config.acl.global= \\ allow client-ip 1.2.3.4 allow client-ip 1.7.12.123 allow client-ip 1.8.123.32 allow client-ip 1.9.132.38 allow client-ip 1.10.132.39 allow client-ip 1.10.132.40 allow client-ip 1.10.132.50 allow server-name 'intranet.company.com' try-auth any deny user paul deny user bmay allow auth deny any \\`
5	As they have been configured in Stage 2, ApplianceA, ApplianceB, ApplianceC, and ApplianceD read the bypassauth.cfg file on ServerA every 24 hours (1440 minutes) and incorporate its modified settings into their active configurations.