ProCurve 6200yl User's Guide download pdf (Page 310)

100

101

10-24

Access Control Lists (ACLs)

Overview

General Steps for Planning and Configuring ACLs

1. Identify the ACL application to apply. As part of this step, determine the

best points at which to apply specific ACL controls. For example, you can

improve network performance by filtering unwanted IP traffic at the edge

of the network instead of in the core. Also, on the switch itself, you can

improve performance by filtering unwanted IP traffic where it is inbound

to the switch instead of outbound.

2. Identify the IP traffic types to filter:

• The SA and/or the DA of IP traffic you want to permit or deny. This

can be a single host, a group of hosts, a subnet, or all hosts.

• Any IP traffic of a specific protocol type (0-255)

• Any TCP traffic (only) for a specific TCP port or range of ports,

including optional control of connection traffic based on whether the

initial request should be allowed

• Any UDP traffic (only) or UDP traffic for a specific UDP port

• Any ICMP traffic (only) or ICMP traffic of a specific type and code

• Any IGMP traffic (only) or IGMP traffic of a specific type

• Any of the above with specific precedence and/or ToS settings

3. Design the ACLs for the control points (interfaces) you have selected.

Where you are using explicit “deny” ACEs, you can optionally use the ACL

logging feature for notification that the switch is denying unwanted

packets.

4. Configure the ACLs on the selected switches.

IP Traffic Source ACL Application

IP traffic from a specific, authenticated

client

dynamic port ACL (RADIUS-assigned ACL)

for inbound IP traffic from an authenticated

client on a port*

IP traffic entering the switch on a specific

port

static port ACL (static-port assigned) for

any inbound IP traffic on a port from any

source

switched or routed IP traffic entering the

switch on a specific VLAN

VACL (VLAN ACL)

routed IP traffic entering or leaving the

switch on a specific VLAN

RACL (routed ACL)

*For more on this option, refer to chapter 7, “Configuring RADIUS Server Support for

Switch Services”, and also to the documentation for your RADIUS server.)

1 2 ... 305 306 307 308 309 310 311 312 313 314 315 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 310

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl