ProCurve 6200yl User's Guide download pdf (Page 313)

100

101

10-27

Access Control Lists (ACLs)

ACL Operation

Note After you assign an ACL to an interface, the default action on the interface is

to implicitly deny any IP traffic that is not specifically permitted by the ACL.

(This applies only in the direction of traffic flow filtered by the ACL.)

The Packet-filtering Process

Sequential Comparison and Action. When an ACL filters a packet, it

sequentially compares each ACE’s filtering criteria to the corresponding data

in the packet until it finds a match. The action indicated by the matching ACE

(deny or permit) is then performed on the packet.

Implicit Deny. If a packet does not have a match with the criteria in any of

the ACEs in the ACL, the ACL denies (drops) the packet. If you need to

override the implicit deny so that a packet that does not have a match will be

permitted, then you can use the “permit any” option as the last ACE in the

ACL. This directs the ACL to permit (forward) packets that do not have a

match with any earlier ACE listed in the ACL, and prevents these packets from

being filtered by the implicit “deny any”.

Example. Suppose the ACL in figure 10-5 is assigned to filter the IP traffic

from an authenticated client on a given port in the switch:

Figure 10-5. Example of Sequential Comparison

As shown above, the ACL tries to apply the first ACE in the list. If there is not

a match, it tries the second ACE, and so on. When a match is found, the ACL

invokes the configured action for that entry (permit or drop the packet) and

For an inbound packet with a destination

IP address of 18.28.156.3, the ACL:

1. Compares the packet to this ACE first.

2. Since there is not a match with the first

ACE, the ACL compares the packet to the

second ACE, where there is also not a

match.

3. The ACL compares the packet to the third

ACE. There is a exact match, so the ACL

denies (drops) the packet.

4. The packet is not compared to the fourth

ACE.

Permit in ip from any to 18.28.136.24

Permit in ip from any to 18.28.156.7

Deny in ip from any to 18.28.156.3

Deny in tcp from any to any 23

Permit in ip from any to any

(Deny in ip from any to any)

This line demonstrates the “deny any any” ACE implicit in every

RADIUS-assigned ACL. Any inbound ip traffic from the

authenticated client that does not have a match with any of the five

explicit ACEs in this ACL will be denied by the implicit “deny any

any”.

1 2 ... 308 309 310 311 312 313 314 315 316 317 318 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 313

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl