In Context aware HTTP cache, you need to set the anonymous X-User-Hash in the VLC for Varnish to work.

if (req.http.Cookie !~ "eZSESSID" && !req.http.authorization) {
	# You may update this hash with the actual one for anonymous user
	# to get a better cache hit ratio across anonymous users.
	# Note: Then needs update every time anonymous user role assignments change.
	set req.http.X-User-Hash = "38015b703d82206ebc01d17a39c727e5";
}

The anonymous X-User-Hash is generated based on the anonymous user, group and role. The _38015b703d82206ebc01d17a39c727e5 will work only if you let these three items untouched. Once you change the default permissions and settings, the X-User-Hash will change and Varnish won't be able to effectively handle cache anymore.

In that way, you need to find out what is the new anonymous X-User-Hash and change the VLC accordingly or Varnish will return a no-cache header.

The easiest way to find the new hash is:

• Connect to your server (shh should be enough)
• Add your-domain.com to your /etc/hosts file (if it's the case)
• Execute the following command:

  $ curl -I -H "Accept: application/vnd.fos.user-context-hash" http://your-domain.com/_fos_user_context_hash

• You should get something like this:

  HTTP/1.1 200 OK
  Date: Mon, 03 Oct 2016 15:34:08 GMT
  Server: Apache/2.4.18 (Ubuntu)
  X-Powered-By: PHP/7.0.8-0ubuntu0.16.04.2
  X-User-Hash: b1731d46b0e7a375a5b024e950fdb8d49dd25af85a5c7dd5116ad2a18cda82cb
  Cache-Control: max-age=600, public
  Vary: Cookie,Authorization
  Content-Type: application/vnd.fos.user-context-hash

• Now, take the displayed X-User-Hash value and update your VCL
  Unable to find source-code formatter for language: diff. Available languages are: actionscript, ada, applescript, bash, c, c#, c++, cpp, css, erlang, go, groovy, haskell, html, java, javascript, js, json, lua, none, nyan, objc, perl, php, python, r, rainbow, ruby, scala, sh, sql, swift, visualbasic, xml, yaml

  # Note: Then needs update every time anonymous user role assignments change.
  - set req.http.X-User-Hash = "38015b703d82206ebc01d17a39c727e5";
  + set req.http.X-User-Hash = "b1731d46b0e7a375a5b024e950fdb8d49dd25af85a5c7dd5116ad2a18cda82cb";

• Restart the Varnish server and everything should work fine.

These steps must be documented in Context aware HTTP cache and any other relevant documentation page.