About setting restrictions

Controlling access

NetCache enables you to create ACL settings that

Control access to individual URLs or entire Web domains
Restrict the IP addresses from which users can make Web requests
Redirect requests for restricted objects to other URLs

Policies

The following set of rules is an example of ACL entries working together to form an access control policy:

deny url "http://www.corp.com"

allow time 9am - 5am

deny group marketing

deny ftp

In this example, the following access control policy is implemented:

Deny access to a specified URL.
Allow access to services during the specified time.
Deny requests from members of the marketing group.
Deny all FTP requests only. Requests for supported protocols other than FTP are allowed.

Ordering rules within a policy

When you form rules and create policies, it is important to consider the logical order in which ACLs are read. NetCache starts at the top on an ACL list and reads down until it finds a match. ACL rules must be ordered correctly to ensure that efficient rule matching occurs.

Example

NetCache checks global authentication before checking permissions that are applied to individual users or groups. If protocol requests are authenticated using a rule such as auth any, that rule must be placed above any rules that contain user or group variables. Otherwise, rule checking continues through the list, and authentication is not applied as intended.

The following policy illustrates correct order:

allow server-domain company.com

allow server-domain travel.com

allow client-ip 128.126.10.40

auth any

allow group execs

allow group humanresources and smartfilter job

deny any

This access control policy can be stated as follows:

Allow access to the company domain.

Allow access to travel.

Allow client IP-based access.

Authenticate all requests.

Allow access for members of the executive group

Allow access for members of the human resources group and allow this group access to specific Web sites.

Deny all requests.

Note
This example assumes that protocol authentication is not globally enabled on the Setup > Authentication General page.

Use caution when setting rules

The type of rule and the number of rules that NetCache must check before servicing each request can affect performance. For example, rules containing the server-ip variable prompt a cached DNS lookup that might be slower than using the server-name variable to specify server names.

In general, order your rules so that specific restrictions are listed before broad restrictions. Carefully plan the access restrictions you want to impose. Configure only the rules that are required for your environment, and where possible, collapse several rules into a single rule.