Scenario 3: Multiple matching rules by source and destination – rule ordering priority in effect
Resource A -> 10.10.10.0/24.
Resource B -> 10.10.10.10.
Access policy rules:
- UserGroupA has access to Resource A.
- UserGroupA has access to Resource B.
Behavior:
- Like the earlier scenarios, a request to “10.10.10.10” would match to both resources A and B.
- Unlike earlier scenarios, both rules can now apply to the same user (from UserGroupA) and both rules can provide access but to 2 different resources.
- But, ZTA top-down rule enforcement based on rule priority is maintained, and because a request from UserGroupA to “10.10.10.10” would match to rule #1, rule #2 would never even be checked; the rule providing access to Resource B would never be hit, even though it is the most specific resource.