ProCurve 6200yl User's Guide download pdf (Page 228)

7-22

Configuring RADIUS Server Support for Switch Services

Configuring and Using RADIUS-Assigned Access Control Lists

Configuration Notes

Explicitly Permitting Any IP Traffic. Entering a permit in ip from any to any

(permit any any) ACE in an ACL permits all IP traffic not previously permitted

or denied by that ACL. Any ACEs listed after that point do not have any effect.

Explicitly Denying Any IP Traffic. Entering a deny in ip from any to any

ACE in an ACL denies all IP traffic not previously permitted or denied by that

ACL. Any ACEs listed after that point have no effect.

Implicitly Denying Any IP Traffic. For any packet being filtered by a

static port ACL, there will always be a match. That is, any packet that does

not have a match with an explicit permit or deny ACE in the list will match

with the implicit deny in ip from any to any that is automatically implied at the

end of the list. Thus, the ACL denies any IP packet it filters that does not match

any explicitly configured ACE. If you want an ACL to permit any packets that

from any: Required keywords specifying the (authenticated) client source. (Note that a

dynamic port ACL assigned to a port filters only the inbound traffic having a source MAC

address that matches the MAC address of the client whose authentication invoked the ACL

assignment.)

to: Required destination keyword.

< ip-addr >: Specifies a single destination IP address.

< ip-addr /< mask >: Specifies a series of contiguous destination IP addresses or all

destination IP addresses in a subnet. The < mask > is CIDR notation for the number

of leftmost bits in a packet’s destination IP address that must match the corre-

sponding bits in the destination IP address listed in the ACE. For example, a

destination of 10.100.17.1/24 in the ACE means that a match occurs when an

inbound packet (of the designated IP type) from the authenticated client has a

destination IP address where the first three octets are 10.100.17. (The fourth octet is

a wildcard, and can be any value up to 255.)

any: Specifies any IP destination address. Use this option when you want the ACL

action to apply to all traffic of the designated type, regardless of destination.

[ tcp/udp-ports]: Optional TCP or UDP port specifier. Used when the ACL is intended to filter

client TCP or UDP traffic with one or more specific TCP or UDP destination port numbers.

You can specify port numbers as individual values and/or ranges. For example, the

following ACE denies any UDP traffic from an authenticated client that has a DA of any

IP address and a UDP destination port of 135, 137-139, or 445:

deny in udp from any to any 135, 137-139, 445

[ cnt ]:

Optional counter specifier for a dynamic port ACL. When used in an ACL, the counter

increments each time there is a “match” with a permit or deny ACE. This option requires

that you configure the switch for RADIUS accounting.

1 2 ... 223 224 225 226 227 228 229 230 231 232 233 ... 595 596

No comments

ProCurve 6200yl User's Guide Page 228