ProCurve 6200yl User's Guide download pdf (Page 320)

100

101

10-34

Access Control Lists (ACLs)

Planning an ACL Application

• Numeric Standard ACLs: Up to 99; numeric range: 1 - 99

• Numeric Extended ACLs: Up to 100; numeric range: 100 - 199

• Total ACEs in all ACLs: Depends on the combined resource usage by

ACL, QoS, IDM, Virus-Throttling, ICMP, and Management VLAN fea-

tures (For more on this topic, refer to “Monitoring Shared Resources”

on page 10-114.)

■ Implicit Deny: In any ACL, the switch automatically applies an

implicit “deny IP any” that does not appear in show listings. This

means that the ACL denies any packet it encounters that does not

have a match with an entry in the ACL. Thus, if you want an ACL to

permit any packets that you have not expressly denied, you must enter

a permit any or permit ip any any as the last ACE in an ACL. Because,

for a given packet the switch sequentially applies the ACEs in an ACL

until it finds a match, any packet that reaches the permit any or permit

ip any any entry will be permitted, and will not encounter the “deny ip

any” ACE the switch automatically includes at the end of the ACL. For

an example, refer to figure 10-7 on page 10-29.

■ Explicitly Permitting Any IP Traffic: Entering a permit any or a

permit ip any any ACE in an ACL permits all IP traffic not previously

permitted or denied by that ACL. Any ACEs listed after that point do

not have any effect.

■ Explicitly Denying Any IP Traffic: Entering a deny any or a deny ip

any any ACE in an ACL denies all IP traffic not previously permitted

or denied by that ACL. Any ACEs listed after that point have no effect.

■ Replacing One ACL with Another Using the Same Application:

For a specific interface, the most recent ACL assignment using a given

application replaces any previous ACL assignment using the same

application on the same interface. For example, if you configured an

RACL named “100” to filter inbound routed IP traffic on VLAN 20, but

later, you configured another RACL named 112 to filter inbound

routed IP traffic on this same VLAN, RACL 112 replaces RACL 100 as

the ACL to use.

■ Static Port ACLs: These are applied per-port, per port-list, or per

static trunk. Adding a port to a trunk applies the trunk’s ACL config-

uration to the new member. If a port is configured with an ACL, the

ACL must be removed before the port is added to the trunk. Also,

removing a port from an ACL-configured trunk removes the ACL

configuration from that port.

1 2 ... 315 316 317 318 319 320 321 322 323 324 325 ... 595 596

Comments to this Manuals

No comments

ProCurve 6200yl User's Guide Page 320

Comments to this Manuals

Related products and manuals for Network switches ProCurve 6200yl