ProCurve 6200yl User's Guide download pdf (Page 334)

10-48

Access Control Lists (ACLs)

Configuring and Assigning an ACL

Allowing for the Implied Deny Function

In any ACL having one or more ACEs there will always be a packet match.

This is because the switch automatically applies an Implicit Deny as the last

ACE in any ACL. This function is not visible in ACL listings, but is always

present. (Refer to figure 10-13.) This means that if you configure the switch to

use an ACL for filtering either inbound or outbound IP traffic on a VLAN, any

packets not specifically permitted or denied by the explicit entries you create

will be denied by the Implicit Deny action. If you want to preempt the Implicit

Deny (so that IP traffic not specifically addressed by earlier ACEs in a given

ACL will be permitted), insert an explicit permit any (for standard ACLs) or

permit ip any any (for extended ACLs) as the last explicit ACE in the ACL.

A Configured ACL Has No Effect Until You Apply It

to an Interface

The switch stores ACLs in the configuration file. Thus, until you actually assign

an ACL to an interface, it is present in the configuration, but not used (and

does not use any of the monitored resources described in the appendix titled

“Monitored Resources” in the Management and Configuration Guide for

your switch.)

You Can Assign an ACL Name or Number to an Interface Even

if the ACL Does Not Exist in the Switch’s Configuration

In this case, if you subsequently create an ACL with that name or number, the

switch automatically applies each ACE as soon as you enter it in the running-

config file. Similarly, if you modify an existing ACE in an ACL you already

applied to an interface, the switch automatically implements the new ACE as

soon as you enter it. (See “General ACL Operating Notes” on page 10-113.) The

switch allows a maximum of 2048 ACLs in any combination of numeric and

alphanumeric names, and determines the total from the number of unique ACL

names in the configuration. For example, if you configure two ACLs, but assign

only one of them to a VLAN, the ACL total is two, for the two unique ACL

names. If you then assign the name of a nonexistent ACL to a VLAN, the new

ACL total is three, because the switch now has three unique ACL names in its

configuration.

n/a The Implicit Deny is a function the switch automatically adds as the last action in all ACLs. It denies (drops) any

IP traffic from any source to any destination that has not found a match with earlier entries in the ACL. In this

example, the ACE at line 50 permits (forwards) any IP traffic not already permitted or denied by the earlier

entries in the list, so there is no traffic remaining for action by the Implicit Deny function.

exit Marks the end of the ACL.

Line # Action

1 2 ... 329 330 331 332 333 334 335 336 337 338 339 ... 595 596

No comments

ProCurve 6200yl User's Guide Page 334