Configure Access Rules on Versa Director
For supported software information, click here.
You can configure access rules to allow or deny the traffic from client subnets when accessing Versa Director. You configure the rules at the system level (provider rules) or tenant level. The rules can be username-based or role-based. If no rule is configured, access is allowed for all users.
When you configure multiple rules, evaluation of the rules is done from top to bottom in the order that they appear on the screen. To process the rules in a different order, you reorder the list of rules. If there are multiple denied rules for a user, the rules are executed top to bottom until an exact match for the denial is found. Otherwise, the access is allowed. If you change the default action to deny, only the rules present are executed and for other users access is denied. A rule is processed in the precedence order based on username, role, and default.
If you configure the Director node northbound IP address, high availability IP addresses, and Analytics IP address with the local host (127.0.0.1), the access is allowed by default. For external authentication methods, such as CA certificate, you need to add the CA client Director node IP address to the allowed IP address list of the CA server if any rule for a specific user is configured. Also, you need to add the Concerto node IP address in the allowed subnet list if any rule is configured.
For high availability, all the rules in the primary Director node are applicable in the secondary Director node.
Note that only users with the ProviderDataCenterSystemAdmin role can configure access rules at both the system level and tenant level. Users with the TenantSuperAdmin role can configure access rules at the tenant level.
Note: If source NAT is enabled for LAN users, the NATed IP is used as a client source IP, and you must configure the allowed subnet list.
Configure an Access Rule
To configure an access rule at the system-level or tenant-level:
- In Director view, select the Administration tab in the top menu bar.
- To add a system-level access rule, select System > Access Rules > System in the left menu bar. Then move to step 4.
- To add a tenant-level access rule, select System > Access Rules > Tenant in the left menu bar.
- To add a username-based access rule, go to the User tab and click the +Add icon.
- If you already added one or more rules, the Add Rule popup window displays the rule reorder window. Select where you want to insert the rule, either at the end of the existing rules, the top of the existing rules, or in a specific location in the list of existing rules.
- Click Continue.
- In the Create User Access Rules window, enter information for the following fields.
Field Description Name (Required) Enter a name for the username-based access rule or select a name from the Username drop-down list. Organization (Required) This field is selected automatically and not editable. Rule Type (Required) This field is selected automatically and not editable. Allowed Users (Required) - Username (Required)
Select one or more local users from the drop-down list, and then click the Add icon. Allowed Source Address Prefixes - IP Address (Required)
Enter one or more source IP address prefixes to to send all traffic from the user device to Versa Director, and then click the 
Add icon.Denied Source Address Prefixes - IP Address (Required)
Enter one or more subnet IP prefixes to drop all traffic that matches the rule, and then click the Add icon. - Click Ok.
- To add a role-based access rule, select the Role tab, and then click the +Add icon.
- If you already added one or more rules, the Add Rule popup window displays the rule reorder window. Select where you want to insert the policy rule, either at the end of the existing rules, the top of the existing rules, or in a specific location in the list of existing rules.
- Click Continue.
- In the Create Role Access Rules window, enter information for the following fields.
Field Description Name (Required) Enter a name for the role-based access rule. Organization (Required) This field is selected automatically and not editable. Rule Type (Required) This field is selected automatically and not editable. Allowed Roles (Required) - Role (Required)
Select one or more roles from the drop-down list, and then click the Add icon. Allowed Source Address Prefixes - IP Address (Required)
Enter one or more source IP address prefixes to to send all traffic from the user device to Versa Director, and then click the Add icon.Denied Source Address Prefixes - IP Address (Required)
Enter one or more subnet IP prefixes to drop all traffic that matches the rule, and then click the Add icon. - Click Ok.
- Select Default tab. In the Default Access Rules pane, click the
Edit icon.
- In the Edit Default Access Rules window, select the action to take on matching traffic:
- Allow (This is the default action)
- Deny
- Click Ok.
Reorder Access Rules
To reorder system-level or tenant-level access rules:
- In Director view, select the Administration tab in the top menu bar.
- Select System > Access Rules in the left menu bar, and then:
- To reorder a system-level access rule, select System.
- To reorder a tenant-level access rule, select Tenant.
- Select a rule name, and then click the
Move icon.
- In the Move popup window, select where you want to insert the selected rule, either at the end of the existing rules, the top of the existing rules, or in a specific location in the list of existing rules.
- To move rule(s) to a specific location, slide the blue Place Here bar to indicate where you want to place the rule(s).
- Click Reorder Rule.
Note: There must be at least one rule to allow a PDCSA user at any time to get the rule updated.
Supported Software Information
Releases 22.1.4 (Service Release dated 2025-02-08) and later support all content described in this article.