DynaBLocator blocking with ACLs

About this section

This section contains a few examples of how you might use ACL rules with DynaBLocator.

Before setting ACLs for DynaBLocator

Before setting ACLs for DynaBLocator, you must configure basic DynaBLocator options, as described in Basic DynaBLocator options. If DynaBLocator is not enabled, NetCache ignores DynaBLocator ACLs.

Ways of configuring ACLs for DynaBLocator

Methods of configuring ACLs for DynaBLocator are shown in the following table.

Method	Description
Create standard HTTP ACL rules on the Access Controls pages (manually entered ACL rules)	This method enables you to use a full suite of building blocks for creating ACLs. For example, you can allow some users access to specific URLs and deny other users; you can deny or allow access to specific URLs. This method requires sound knowledge of ACL building blocks and syntax.
Use the ACL wizard for DynaBLocator	You can allow some URLs in DynaBLocator categories that you have blocked globally. The ACL wizard can be used to allow only URLs containing phrases that you specify. This method is a simple way of creating ACLs because it does not require knowledge of ACL building blocks and syntax. The Exceptions to Full Category Blocking option on the WebWasher - DynaBLocator page is the ACL wizard.

DynaBLocator restrictions are checked after ACLs

NetCache invokes restrictions associated with DynaBLocator in the following order:

Standard ACLs (that is, ACLs set on the Access Controls pages) or ACL rules set through the ACL wizard (that is, the Exceptions to Full Category Blocking option on the WebWasher - DynaBLocator page).
NetCache evaluates the settings in the Exceptions to Full Category Blocking option after the standard ACLs.
Any category blocking that you might have set for user authentication groups.
Category restrictions set on the WebWasher - DynaBLocator page.

Examples of when you might use an ACL

The benefit of NetCache invoking ACL rules before checking DynaBLocator category restrictions set on the WebWasher - DynaBLocator page is that you can set ACL rules to allow exceptions to the categories for which you have blocked access. For example, after you enable DynaBLocator and specify content categories to be restricted, you could create an ACL rule to

Allow access to a specific URL that DynaBLocator would block because it matches a category that you have blocked
For instructions on how to exclude a URL from DynaBLocator blocking, see the Appliance Manager online Help
Allow a specific user access to a content category that you have blocked. (This is not possible to set up with the ACL wizard.)
For instructions on how to allow a specific user access to a blocked DynaBLocator category, see the Appliance Manager online Help.

Examples of ACL rules with the DynaBLocator ACL wizard

Assume that you have blocked the category Software and Hardware Vendors/Distributors, but you wanted to allow access to the Network Appliance Web site. You could enter any of the following in the Exceptions to Full Category Blocking option on the WebWasher - DynaBLocator page to allow access to the Network Appliance Web site:

http://www.netapp.com
www.netapp.com
netapp.com

If you enter a phrase, it must be an exact match. The phrase "net app" does not return http://www.netapp.com because of the embedded white space.

Examples of ACL rules with standard ACLs

The following examples show ACL rules that exempt specific URLs from blocking.

Example 1:

The following rule shows how to specify either a URL string or a regular expression of a set of URLs to be exempted from blocking:

allow url-prefix http://www.corp.com

This rule explicitly allows access to a URL blocked by DynaBLocator for all users of the NetCache service.

Example 2:

The following rule shows how to specify an IP address or range of IP addresses, in addition to a regular expression of a set of URLs, to be exempted from DynaBLocator blocking:

allow client-ip 128.125.51 and url-prefix http://www.corp.com

This rule explicitly allows access to a URL only for specified clients.

See Chapter 2, Access Control, for details about ACLs.