Forming rules

ACLs

ACL entries allow or deny requests based on a number of variables, such as client IP addresses. ACLs are associated with specific users, and groups of users.

When ACL rules are formed, actions are combined with expressions that contain a variable-value pair. Variables and associated values form what is commonly referred to as a pattern-matching expression.

Syntax

When applying actions (for example, allow, deny, redirect, rewrite, and auth) to matching expressions, use the action expression syntax, as shown in the following table.

Action	Expression
`allow`	`client-ip 128.126.10.0`
`auth`	`group admin2`
`deny`	`server-domain net`
`allow`	`time 9am - 5pm`
`deny`	`group novice`

Actions

Actions and expressions form rules that control requests for access to Web content and supported protocols. The following table lists supported actions and describes how they govern client requests.

This action...	Specifies...
`allow`	Allow the request to proceed and disregard all the following rules.
`auth`	Require authentication and continue the rule checking sequence if already authenticated.
`deny`	Deny the request immediately.
`drop` <ttl> where ttl is length of time in seconds. Default is 60 seconds.	Block packets from the source specified. For example, when used with the client-ip variable, packets from a matched client IP address are blocked at the IP level.
`no-log`	Selectively log and filter log file information by field. If applied as a global ACL, all logs are filtered. Entries in log files are replaced with a "-". Note Global authentication must be enabled.
`proxy`	Proxy session. Do not serve from cache.
`re-auth`	Force reauthentication.
`redirect` <url>	Redirect the request immediately.
`rewrite`	Rewrite the URL, but continue the rule checking sequence.
`try-auth`	Require authentication and continue the rule checking sequence even if authentication fails.

Variables

Variables are assigned values that form expressions, for example, time 9am - 5pm. The following table lists variables and provides a description and example of each.

Variable/Description	Example
`accel` Web Accelerator requests	`deny accel`
`any` Any requests	`deny any`
`auth` Authenticated request	`auth any`
`cache-ip` IP address of this NetCache	`allow cache-ip` `206.80.5.0/24`
`cache-port` Port number on this NetCache	`deny cache-port` 8080
`client-domain` Client domain name	`deny client-domain .wisc.edu`
`client-ip` Client IP address	`deny client-ip 206.79.5.51`
`client-port` Client port number	`deny client-port 25`
`contains` Substring search operator Note This variable supports user, group, req-headers, server-name, client-domain, and server-domain variables.	`deny url contains bomb`
`contains-case` Case-sensitive substring search operator Note This variable supports user, group, server-name, client-domain, and server-domain variables.	`deny url contains-case VIOlence`
`date` Date and time	`deny group novice and date "sun nov 6 08:49:37 2002"`
`day` Day	`allow day mon - fri`
`group` Multidomain support for groups. Note A group name with no domain name matches any group with that name, regardless of the domain.	`auth any` `allow group admins` `deny any` This ACL allows access for members of group "admins" in all trusted domains
`group\` Multidomain support for groups. Note Using the "\" delimiter between the domain name and group name enables domain comparison.	`auth any` `allow group "ADMINS\globalgroup"` `deny group "NOVICE\globalgroup"` `deny any` This ACL allows access for members of ADMINS, and denies access for members of NOVICE. Globalgroup is a trusted domain.
`http` HTTP requests	`deny url "http://www.corp.com"`
`server-domain` Server domain name	`allow server-domain .mycorp.com`
`server-ip` Server IP address	`deny server-ip 206.79.5.0/24`
`server-name` Server name in URL	`allow server-name www.mine.com`
`server-port` Server port number in URL	`deny server-port 1 - 1024`
`time` Time Note The time variable syntax is restrictive, and is supported only when expressed as a range or as part of a regex matching expression.	`allow time 9am - 5pm`
`url` URL string	`deny url http://www.mine.com/`
`url-prefix` Prefix of URL string	`deny url-prefix http://www.mine`
`user` User name of authenticated user	`deny user bob`

Variable/Description

Example

accel

Web Accelerator requests

deny accel

any

Any requests

deny any

auth

Authenticated request

auth any

cache-ip

IP address of this NetCache

allow cache-ip 206.80.5.0/24

cache-port

Port number on this NetCache

deny cache-port 8080

client-domain

Client domain name

deny client-domain .wisc.edu

client-ip

Client IP address

deny client-ip 206.79.5.51

client-port

Client port number

deny client-port 25

contains

Substring search operator

Note
This variable supports user, group, req-headers, server-name, client-domain, and server-domain variables.

deny url contains bomb

contains-case

Case-sensitive substring search operator

Note
This variable supports user, group, server-name, client-domain, and server-domain variables.

deny url contains-case VIOlence

date

Date and time

deny group novice and date "sun nov 6 08:49:37 2002"

day

Day

allow day mon - fri

group

Multidomain support for groups.

Note
A group name with no domain name matches any group with that name, regardless of the domain.

auth any

allow group admins

deny any

This ACL allows access for members of group "admins" in all trusted domains

group\

Multidomain support for groups.

Note
Using the "\" delimiter between the domain name and group name enables domain comparison.

auth any

allow group "ADMINS\globalgroup"

deny group "NOVICE\globalgroup"

deny any

This ACL allows access for members of ADMINS, and denies access for members of NOVICE. Globalgroup is a trusted domain.

http

HTTP requests

deny url "http://www.corp.com"

server-domain

Server domain name

allow server-domain .mycorp.com

server-ip

Server IP address

deny server-ip 206.79.5.0/24

server-name

Server name in URL

allow server-name www.mine.com

server-port

Server port number in URL

deny server-port 1 - 1024

time

Time

Note
The time variable syntax is restrictive, and is supported only when expressed as a range or as part of a regex matching expression.

allow time 9am - 5pm

url

URL string

deny url http://www.mine.com/

url-prefix

Prefix of URL string

deny url-prefix http://www.mine

user

User name of authenticated user

deny user bob

Expressions

Expressions are single predicates, variable-value pairs, range matches, or regular expressions (regex). The following table provides an example of each expression type.

Type	Definition	Example
Single predicate	<variable>	server-ip
Variable-value pair	<variable> <value>	client-ip 128.148.37.17
Range matching	<variable> <value> - <value>	server-port 1- 1024
Regular expression matching (regex)	<variable> matches <regex>	"^http://[0-9.]+/redcodeworm.asp\?X+"

Note
When you create rules, you must enclose values that contain white space or nonalphanumeric characters in double quotation marks.

Operators

Complex expressions are built using parentheses and boolean operators, such as and or &&, or or ||, and not. For example:

<expr> and <expr>
<expr> or <expr>
(<expr>)
not <expr>
Caution
Using the operator not in combination with the action allow (for example, allow not user user1) does not result in an action to deny requests when the rule is applied.

Use caution when setting rules

The type of rule and the number of rules that the appliance must check before servicing each request can affect performance. For example, rules containing the server-ip variable prompt a cached DNS lookup that might be slower than using the server-name variable to specify server names.

In general, order your rules so that specific restrictions are listed before broad restrictions. Carefully plan the access restrictions you want to impose. Configure only the rules that are required for your environment, and where possible, collapse several rules into a single rule.