To Next Page

To Previous Page

IPv4 Access Control Lists (ACLs)

Planning an ACL Application

Thus, the bits set to 1 in a network mask define the part of an IPv4 address to

use for the network number, and the bits set to 0 in the mask define the part

of the address to use for the host number.

In an ACL, IPv4 addresses and masks provide criteria for determining whether

to deny or permit a packet, or to pass it to the next ACE in the list. If there is

a match, the configured deny or permit action occurs. If there is not a match,

the packet is compared with the next ACE in the ACL. Thus, where a standard

network mask defines how to identify the network and host numbers in an

IPv4 address, the mask used with ACEs defines which bits in a packet’s SA or

DA must match the corresponding bits in the SA or DA listed in an ACE, and

which bits can be wildcards.

Rules for Defining a Match Between a Packet and an

Access Control Entry (ACE)

■ For a given ACE, when the switch compares an IPv4 address and

corresponding mask in the ACE to an IPv4 address carried in a packet:

• A mask-bit setting of 0 (“off”) requires that the corresponding bits

in the packet’s address and in the ACE’s address must be the same.

Thus, if a bit in the ACE’s address is set to 1 (“on”), the same bit in the

packet’s address must also be 1.

• A mask-bit setting of 1 (“on”) means the corresponding bits in the

packet’s address and in the ACE’s address do not have to be the same.

Thus, if a bit in the ACE’s address is set to 1, the same bit in the packet’s

address can be either 1 or 0 (“on” or “off”).

For an example, refer to “Example of How the Mask Bit Settings Define

a Match” on page 9-31.

■ In any ACE, a mask of all ones means any IPv4 address is a match.

Conversely, a mask of all zeros means the only match is an IPv4

address identical to the host address specified in the ACE.

■ Depending on your network, a single ACE that allows a match with

more than one source or destination IPv4 address may allow a match

with multiple subnets. For example, in a network with a prefix of

31.30.240 and a subnet mask of 255.255.240.0 (the leftmost 20 bits),

applying an ACL mask of 0.0.31.255 causes the subnet mask and the

9-29

Other manuals for HP PROCURVE 2910AL

Questions and Answers:

Need help?

Do you have a question about the HP PROCURVE 2910AL and is the answer not in the manual?

General