Design Guidelines for Access Rules

Because the appliance processes your access control rules sequentially, the order in which you organize them is significant in terms of whether access is permitted or denied. Carefully review your security policy settings to avoid inadvertently placing rules in the wrong order.

• Put your most specific rules at the top of the list. As a general rule, it is best to put your most specific rules at the top of the list. Putting broader rules that grant more permissions at the top of the list may cause the appliance to find a match before it has a chance to process your more restrictive rules.
• Be careful with Any rules. If you create a rule that does not restrict access to a particular user or destination resource, carefully consider its impact on policy rules.
• Optimizing performance. Because the appliance evaluates rules in sequential order, you can optimize performance by placing the network resources that are accessed most frequently at the top of the list.
• Avoid resource and access method incompatibilities. In some very specific cases, certain combinations of resource types and access methods can create problems with your access policy. AMC validates your rule and notifies you of potential problems when you save it. Refer to “Security Administration” in the Installation and Administration Guide for details on resolving incompatibility issues.