Scenario 1: FQDN resource-based rule at higher priority than IP resource-based rule
Resource A -> defined with destination “acme.com”, which resolves to 10.10.10.10.
Resource B -> defined with destination “10.10.10.0/24”.
Access policy rules:
- UserGroupA has access to Resource A
- UserGroupA has access to Resource B
- UserGroupB has access to Resource A
- UserGroupB has access to Resource B
Behavior:
- When a user in either group A or B accesses the “acme.com” destination, they would be matched to both Resource A and B; however, due to rule priority ordering, they would match to rules #1 and #3 respectively for all accesses. They would never match to the resolved-IP based resource.
- When a user in either group A or B accesses an IP within the “10.10.10.0/24” CIDR, they would be matched to only Resource B. As a result, they would only ever match to rules #2 and #4 respectively for all accesses.