Access Control Lists

About Access Control Lists

APM® access control lists (ACLs) restrict user access to host and port combinations that are specified in access control entries (ACEs). An ACL can apply to Layer 4 (the protocol layer), Layer 7 (the application layer), or both. A Layer 4 or Layer 7 ACL is used with network access, application access, or web access connections.

You may use BIG-IQ to configure user-defined ACLs and may use it to view and manage other types of ACLs. All types of ACLs excluding user-defined ACLs are generated automatically by the system and may not be removed.

You may manually create an ACL, an ACL can be dynamically generated on the system, or an ACL can be defined automatically on the system when you create:

• A portal access resource
• An app tunnel
• A remote desktop

You may use BIG-IQ to change the ACL order for all ALCs except user-defined ACLs. To do so, navigate to Configuration > ACCESS > Access Groups and select or create an Access Group. Click ACCESS CONTROL LISTS > All ACLs. Follow the procedure below to manage ACL order and to learn more about what configurations you may apply to ACLs.

Configuring user-defined ACLs

You may create or edit a user-defined Access Control List from BIG-IQ.

1. At the top of the screen, select Configuration, then on the left side of the screen, click ACCESS > Access Groups.

2. Click the name of an Access group.

   A new screen displays the group’s properties.

3. Navigate to Access Control Lists > User-defined ACLs.

4. The screen displays the user-defined ACLs (either the shared or the device-specific) in the working configuration for the Access group.

   • To create a new shared or device-specific ACL, click the Create button under User-defined ACLs (Shared) or User-defined ACLs (Device-specific).
   • To delete a user-defined ACL, select the check box next to the ACL and click the Delete button. However, you cannot delete a pinned ACL or an ACL that is referenced by an access policy.
   • Reorder user-defined shared or device-specific ACLs by alhabetical or reverse-alphabetical order by selecting the column ACL Order to toggle between these two methods of organization.

5. Select Create or select an existing ACL to begin configuration.

6. Enter a Name for this user-defined ACL.

7. Enter a Partition. The default is Common. You can also enter a custom path to a partition you have created. Only users with access to a partition can view the objects that the partition contains. If the object resides in the Common partition, all users can access it.

8. In the ACL Order field, type a number to specify the order of this ACL relative to others.

9. To consider alphabetic case when matching paths in an access control entry, in the Configuration area for Match Case For Paths, select Yes; otherwise, select No.

10. To specify the properties of an access control entry, click Add or click an existing access control entry.

11. Note: Layer 4 access control entries operate on the protocol layer only; for layer 4, you can configure only the protocols and addresses on which to act. Layer 7 access control entries work on the application layer; for layer 7, you can configure hosts and paths and select a URI scheme.

12. For Type, select L4, L7, or L4+7 to specify the TCP layer on which the access control entry operates.

    Note: With Network Access, you can use a Layer 7 ACL that is configured to provide access control for port 80 HTTP connections. However, to provide access control for other ports, you must create a second virtual server that is configured with the default access profile and the IP address to which the ACL entry applies.

    Note: For HTTPS connections, the system can apply Layer 7 ACL entries only if the virtual server has the private key of the backend server.

13. For Source IP Address, select a Type of address to match: Host, Network, or Any and, fill in any additional fields that display, such as Address and Mask.

14. For Source Port(s), specify a port or range of ports.

15. For Destination IP Address, select a Type of address to match: Host, Network, or Any and fill in any additional fields that display, such as Address and Mask.

16. For Destination Port(s), specify a port or range of ports.

17. For Layer 4, (L4or L4+7) for Protocol select the protocol to which the entry applies.

18. For Layer 7, (L7or L4+7) for Scheme select HTTP, HTTPS, or Any.

19. For Layer 7, for Host Name specify a host name.

    You can use wildcard characters. To represent one or more characters, use an asterisk (*). To represent a single character, use a question mark (?).

20. For Layer 7, for Paths type one or more URIs separated by spaces.

    You can use wildcard characters as specified for Host Name.

21. For Action select the action for the ACL to take when this access control entry is encountered.

    • Allow - Allow the traffic.

    • Continue - Skip checking the remaining entries in this ACL and continue evaluation at the next ACL.

    • Discard - Drop the packet silently.

    • Reject - Drop the packet and send TCP RST (on TCP flows), or proper ICMP messages (on UDP flows), or, on other protocols, silently drop the packet.

      Note: For HTTP traffic only, no TCP RST message is sent; instead, an ACL deny page displays.

22. For Log, select an option for logging for when actions of this type occur:

    • None - Log nothing.
    • Packet - Log the matched packet.

23. Click Save & Close.

The new user-defined ACL will be displayed in the User-defined ACL list.