To Next Page

To Previous Page

IPv4 Access Control Lists (ACLs)

Planning an ACL Application

■ Generally, you should list ACEs from the most specific (individual

hosts) to the most general (subnets or groups of subnets) unless doing

so permits traffic that you want dropped. For example, an ACE

allowing a small group of workstations to use a specialized printer

should occur earlier in an ACL than an entry used to block widespread

access to the same printer.

IPv4 ACL Configuration and Operating Rules

■ Static Port ACLs: A static port ACL filters traffic entering the switch

on the port(s) or trunk(s) to which it is assigned.

■ Per Switch ACL Limits for All ACL Types. At a minimum an ACL

must have one, explicit “permit” or “deny” Access Control Entry. You

can configure up to 512 ACLs. For IPv4 ACLs, the maximums are as

follows:

• Named (Extended or Standard) ACLs: Up to 512 (minus any numeric

standard or extended ACL assignments)

• Numeric Standard ACLs: Up to 99; numeric range: 1 - 99

• Numeric Extended ACLs: Up to 100; numeric range: 100 - 199

• The maximum number of ACEs supported by the switch is up to 1024

for IPv4 ACEs. The maximum number of ACEs allowed on a port

depends on the concurrent resource usage by multiple configured

features. For more information, use the show < qos | access-list >

resources command and/or refer to “Monitoring Shared Resources”

on page 9-100.

■ Implicit Deny: In any static IPv4 ACL, the switch automatically

applies an implicit deny ip any that does not appear in show listings.

This means that the ACL denies any IPv4 packet it encounters that

does not have a match with an entry in the ACL. Thus, if you want an

ACL to permit any packets that you have not expressly denied, you

must enter a permit any or permit ip any any as the last ACE in an ACL.

Because, for a given packet the switch sequentially applies the ACEs

in an ACL until it finds a match, any packet that reaches the permit any

or permit ip any any entry will be permitted, and will not encounter the

deny ip any ACE the switch automatically includes at the end of the

ACL. For an example, refer to figure 9-4 on page 9-23. For Implicit

Deny operation in dynamic ACLs, refer to chapter 6, “Configuring

RADIUS Server Support for Switch Services”

9-27

Other manuals for HP PROCURVE 2910AL

Questions and Answers:

Need help?

Do you have a question about the HP PROCURVE 2910AL and is the answer not in the manual?

General