ProCurve 6200yl User's Guide download pdf (Page 314)

100

101

10-28

Access Control Lists (ACLs)

ACL Operation

no further comparisons of the packet are made with the remaining ACEs in

the list. This means that when an ACE whose criteria matches a packet is

found, the action configured for that ACE is invoked, and any remaining ACEs

in the ACL are ignored. Because of this sequential processing, successfully

implementing an ACL depends in part on configuring ACEs in the correct

order for the overall policy you want the ACL to enforce.

Figure 10-6. The Packet-Filtering Process in an ACL with N Entries (ACEs)

Is there a

match?

Perform action

(permit or deny).

Test a packet against

criteria in first ACE.

Yes

Deny the packet

(invoke an Implicit

Deny).

End

Perform action

(permit or deny).

End

Test the packet against

criteria in second ACE.

Is there a

match?

Test packet against

criteria in Nth ACE.

Is there a

match?

Yes

End

Perform action

(permit or deny).

1. If a match is not found with

the first ACE in an ACL, the

switch proceeds to the next

ACE and so on.

2. If a match with an explicit

ACE is subsequently found,

the packet is either permit-

ted (forwarded) or denied

(dropped), depending on

the action specified in the

matching ACE. In this case

the switch ignores all sub-

sequent ACEs in the ACL.

3. If a match is not found with

any explicit ACE in the ACL,

the switch invokes the

Implicit Deny at the end of

every ACL, and drops the

packet.

Note: If the list includes an

ACE configured with Permit

Any forwarding, no packets

can reach the Implicit Deny

at the end of the list. Also,

placing an ACE with Permit

Any forwarding at any point

in an ACL defeats the

purpose of any subsequent

ACEs in the list.

1 2 ... 309 310 311 312 313 314 315 316 317 318 319 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 314

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl