Policy and acl design

[andutt]

Does anybody have any good suggestion howto design the policy and acl structure in a sane matter?

We have reached a point where it takes very long time to implement new rules and applications. So i thought maybe this have been discussed before.

This is how i have planned to redesigned it, any other suggestion or docs i can read or get other opinions?

Code: Select all

                                      default policy
                                               |
                    default acls  -  ipprogram  - noipprogram


[spender]

I'm not sure what you're asking exactly. If you can explain it a bit more, I could be of more help.

-Brad