ProCurve 6200yl User's Guide download pdf (Page 333)

10-47

Access Control Lists (ACLs)

Configuring and Assigning an ACL

significant because, once a match is found for a packet, subsequent ACEs in

the same ACL will not be applied to that packet, regardless of whether they

match the packet.

For example, suppose that you have applied the ACL shown in figure 10-13 to

inbound IP traffic on VLAN 1 (the default VLAN):

Figure 10-13. Example of a Standard ACL that Permits All IP Traffic Not Implicitly Denied

Table 10-7. Effect of the Above ACL on Inbound IP Traffic in the Assigned VLAN

Line # Action

n/a Shows type (extended) and ID (Sample-List-2).

10 A packet from IP source address 10.28.235.10 will be denied (dropped). This ACE filters out all packets received

from 10.28.235.10. As a result, IP traffic from that device will not be allowed and packets from that device will

not be compared against any later entries in the list.

20 A packet from IP source 10.28.245.89 will be denied (dropped). This ACE filters out all packets received from

10.28.245.89. As the result, IP traffic from that device will not be allowed and packets from that device will not

be compared against any later entries in the list.

30 A TCP packet from SA 10.28.18.100 with a DA of 10.28.237.1 will be permitted (forwarded). Since no earlier ACEs

in the list have filtered TCP packets from 10.28.18.100 and destined for 10.28.237.1, the switch will use this ACE

to evaluate such packets. Any packets that meet this criteria will be forwarded. (Any packets that do not meet

this TCP source-destination criteria are not affected by this ACE.)

40 A TCP packet from source address 10.28.18.100 to any destination address will be denied (dropped). Since, in

this example, the intent is to block TCP traffic from 10.28.18.100 to any destination except the destination stated

in the ACE at line 30, this ACE must follow the ACE at line 30. (If their relative positions were exchanged, all TCP

traffic from 10.28.18.100 would be dropped, including the traffic for the 10.28.18.1 destination.)

50 Any packet from any IP source address to any destination address will be permitted (forwarded). The only

traffic to reach this ACE will be IP packets not specifically permitted or denied by the earlier ACEs.

ip access-list extended "Sample-List-2"

10 deny ip 10.28.235.10 0.0.0.0 0.0.0.0 255.255.255.255

20 deny ip 10.28.245.89 0.0.0.0 0.0.0.0 255.255.255.255

30 permit tcp 10.28.18.100 0.0.0.0 10.28.237.1 0.0.0.0

40 deny tcp 10.28.18.100 0.0.0.0 0.0.0.0 255.255.255.255

50 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255

(Implicit Deny)

exit

After the last explicit ACE there is always an Implicit Deny. However, in this case it will not be used because

the last,

permit ip ACL allows all IP packets that earlier ACEs have not already permitted or denied.

Source IP

Destination IP

Mask

1 2 ... 328 329 330 331 332 333 334 335 336 337 338 ... 595 596

No comments

ProCurve 6200yl User's Guide Page 333