acl john src 10.x.y.zacl jane src 10.x.y.t acl facebook dstdomain facebook.com (or .facebook.com) http_access allow john jane facebook.
In case Amos's reference to Common Mistakes didn't help you:The http_access is wrong. It will allow only a client who was both the john IP and the jane IP access to facebook (obviously impossible)
Should be http_access allow john facebook http_access allow jane facebook Alex
