Scenario: Allowing limited access from another company

About this scenario

In this scenario, your company and another company are partners. Your appliance is running as an accelerator. Your domain accelerator appears to the appliance in the partner's domain as if it were a Web server or streaming server.

Goals for this scenario

You have the following goals:

You want certain clients in the partner company to be able to access only a predetermined set of URLs on specified Web servers in your domain.
You want to be able to set different access controls for your company and your partner's company.

Illustration of the scenario topology

The following illustration shows the deployment for this scenario.

Your accelerator host names and IP addresses

The following table shows the configuration of the host name and IP address of the accelerator in your domain.

Option	Configuration data
Appliance Host Name	www.xyz.com
Primary IP Address	IP_address_A

After setup, you can change the Primary IP Address option (on the Network - Interfaces page) and the Appliance Host Name option (on the System - Host Name page) in the Appliance Manager.

Network and URLs to be allowed access

The IP address of the partner's network for which you want to allow access is 128.125.51.0.

You want to allow clients on your partner's network 128.125.51.0 access only to the following URLs on your company's Web servers or streaming servers:

www.xyz.com/specs
www.xyz.com/docs
www.xyz.com/schedule

Acceleration rule on your accelerator

The following acceleration rule is configured on the accelerator in your domain.

Accelerator				Web server
IP	Port	Host	Path	IP/DNS Host	Port	Host	Path
*	80	www.xyz.com	*	www.-internal.xyz.com	8080	*	*

Accelerator ACL rules

The following ACL rules are configured on the accelerator in your domain.

allow client-ip 128.125.51.0 and (url-prefix 
http://www.xyz.com/specs or http://www.xyz.com/docs or 
http://www.xyz.com/schedule)

deny any

The appliance reads the settings in the Accelerator Access Control option as follows. If the request is from the specified network and the client from that network is trying to access one of the three specified URLs, then allow access. Deny all requests that do not match the rules.

client-ip 128.125.51.0 is the subnetwork from which clients in the partner's company can access your accelerator.
url-prefix http://www.xyz.com/specs or http://www.xyz.com/docs or http://www.xyz.com/schedule are the URLs that clients on the partner's network can access.
deny any specifies that no other networks can access the accelerator, and clients on the specified network can only access the three specified URLs. The deny any rule was entered at the end of the Accelerator Access Control option to allow only hosts on subnet 128.125.51.0 to access the accelerator.

Setting access controls for your company

You want to be able to set access controls for your company that are different from those you set for the partner's company. You can set the rules for your company on the Access Control Lists page in the Appliance Manager.

Because the appliance checks the access control rules in a specified order and because your accelerator access control specifies the subnetwork and URLs to be allowed for the partner's company, the access controls for your company and those for the partner company do not conflict.

Caution
Be sure that when you set up your access control options, you are not compromising your firewall security by allowing access from other outside companies.