ACL entries allow or deny requests based on a number of variables, such as client IP addresses. ACLs are associated with specific users, groups of users, and types of requests, such as HTTP.
When ACL rules are formed, actions are combined with expressions that contain a variable-value pair. Variables and associated values form what is commonly referred to as a pattern-matching expression.
When applying actions (for example, allow, deny, redirect, rewrite, and auth) to matching expressions, use the action expression syntax, as shown in the following table.
Actions and expressions form rules that control requests for access to Web content and supported protocols. The following table lists supported actions, and describes how they govern client requests.
This action...
|
Specifies...
|
|---|
allow
|
Allow the request to proceed and disregard all the following rules.
|
auth
|
Require authentication and continue the rule checking sequence if already authenticated.
|
cache
|
Cache the stream.
This action is used to create rules for controlling streaming media cacheability only.
|
context
|
This action is used to create rules for controlling HTTPS requests, and will direct traffic as defined by an SSL inbound or outbound context. For example:
context "inctx" cache-port 443
context "outctx" server-port 443 and server-ip 10.24.155.13
|
deny
|
Deny the request immediately.
|
drop <ttl>
where ttl is length of time in seconds. Default is 60 seconds.
|
Block packets from the source specified. For example, when used with the client-ip variable, packets from a matched client IP address are blocked at the IP level.
|
icap
|
Directs requests for ICAP services.
|
icapnow
|
This action is used for ICAP services that must be invoked early in an ACL evaluation process. For example, content-filtering services.
|
no-cache
|
Do not cache the stream.
This action is used to create rules for controlling streaming media cacheability only.
|
no-log
|
Selectively log and filter log file information by field. If applied as a global ACL, all logs are filtered. Entries in log files are replaced with a "-".
Note
Global authentication must be enabled. |
proxy
|
Proxy session. Do not serve from cache.
This action is used to create rules for controlling streaming, streaming server accelerator, HTTP, and Web accelerator only.
|
re-auth
|
Force reauthentication.
|
redirect <url>
|
Redirect the request immediately.
|
rewrite
|
Rewrite the URL, but continue the rule checking sequence.
Note
The ACL rewrite action does not support HTTP-based tunneling requests. |
rewrite-redirect
|
Rewrite the URL prefix, and send a redirect.
This action is specific to HTTP, and supported for the url-prefix variable only. If target URL is absent, the Default ACL URL option is used to specify a default URL to redirect or rewrite requests to an internal Web page.
|
try-auth
|
Require authentication and continue the rule checking sequence even if authentication fails.
|
Variable/Description
|
Example
|
|---|
accel
Web Accelerator requests
|
deny accel
|
attribute
Attributes returned by ICAP services.
Note
An ICAP service must be invoked before an attribute check can occur. |
icap(content-filter) not group marketing
deny attribute content-filter news
|
any
Any requests
|
deny any
|
auth
Authenticated request
|
redirect "http://web.com/usage.html" not auth and not url "http://web.com/usage.html"
|
bitrate*
Stream bit rate
|
allow bitrate 0-220kbps
|
cacheable*
Cacheable content
|
deny not cacheable
|
cached*
Cached streams
|
deny group sales and not (cached and bitrate 0k - 100k)
|
cache-ip
IP address of this NetCache
|
allow cache-ip 206.80.5.0/24
|
cache-port
Port number on this NetCache
|
deny cache-port 8080
|
client-domain
Client domain name
|
deny client-domain .wisc.edu
|
client-ip
Client IP address
|
deny client-ip 206.79.5.51
|
client-port
Client port number
|
deny client-port 25
|
contains
Substring search operator
Note
This variable supports user, group, req-headers, server-name, client-domain, and server-domain variables. |
deny url contains bomb
|
contains-case
Case-sensitive substring search operator
Note
This variable supports user, group, req-headers, server-name, client-domain, and server-domain variables. |
deny url contains-case VIOlence
|
date
Date and time
|
deny group sales and date "sun nov 6 08:49:37 2002"
|
day
Day
|
allow day mon - fri
|
ftp
FTP requests
Note
Setting auth ftp is supported for FTP over HTTP requests ony. It is not supported for FTP proxy requests. If auth ftp is used in a proxy configured environment, the appliance will allow FTP requests and bypass the remaining FTP ACLs. |
deny ftp
|
get
HTTP, FTP, NNTP, streaming requests
|
allow get and group readonly
|
gopher
Gopher requests
|
deny gopher
|
group
Multidomain support for groups, including NetCache, Windows, and LDAP.
Note
A group name with no domain name matches any group with that name, regardless of the domain. |
auth any
allow group finance
deny any
This ACL allows access for members of group "finance" in all trusted domains
|
group\
Multidomain support for groups, including NetCache, Windows, and LDAP.
Note
Using the "\" delimiter between the domain name and group name enables domain comparison. |
auth any
allow group "ITALY\globalgroup"
deny group "EUROPE\globalgroup"
deny any
This ACL allows access for members of ITALY, and denies access for members of EUROPE. Globalgroup is a trusted domain.
|
http
HTTP requests
|
deny url "http://www.corp.com"
|
live*
Live streams
|
deny group sales and live and day monday - friday
|
post
HTTP, FTP, NNTP requests
|
allow post and group readwrite
|
req-headers
HTTP request headers
|
deny req-headers matches "User-Agent:.*Mozilla"
|
req-line
HTTP request line
Note
The req-line variable supports method arguments (GET, POST, HEAD), and supports the regex contains and contains-case operators. |
deny req-line matches "GET.*http://badsite*"
deny req-line contains POST
|
server-domain
Server domain name
|
allow server-domain .mycorp.com
|
server-ip
Server IP address
|
deny server-ip 206.79.5.0/24
|
server-name
Server name in URL
|
allow server-name www.mine.com
|
server-port
Server port number in URL
|
deny server-port 1 - 1024
|
smartfilter
SmartFilter categories
|
deny smartfilter "chat" "sports" "games"
|
splittable*
Splittable content
|
deny group sales and note splittable
|
time
Time
Note
The time variable syntax is restrictive, and is supported only when expressed as a range or as part of a regex matching expression. |
allow time 9am - 5pm
|
tunnel
Tunnel requests
|
allow tunnel
|
url
URL string
|
deny url http://www.mine.com/
|
url-prefix
Prefix of URL string
|
deny url-prefix http://www.mine
|
user
User name of authenticated user
|
deny user bob
|
wwfilter
WebWasher DynaBLocator categories
|
deny wwwfilter "job search"
deny wwwfilter sects
|
Expressions are single predicates, variable-value pairs, range matches, or regular expressions (regex). The following table provides an example of each expression type.
For a variety of operators and expressions that can be used to create complex rules, see Pseudogrammar.
