HP PROCURVE 2910AL User Manual

IPv4 Access Control Lists (ACLs)
Configuring and Assigning an IPv4 ACL
For example, figure 9-9 shows how to interpret the entries in an extended ACL.
Figure 9-9. Example of a Displayed Extended ACL Configuration
ProCurve(config)# show running
Running configuration:
; J9146A Configuration Editor; Created on release #W.14.XX
hostname "ProCurve"
ip access-list extended "Sample-List-1"
10 permit ip 10.38.130.55 0.0.0.0 10.38.130.240 0.0.0.0
20 permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 23
30 remark "ALLOWS HTTP FROM SINGLE HOST."
30 permit tcp 10.38.131.14 0.0.0.0 eq 80 0.0.0.0 255.255.255.255 eq 3871
40 remark "DENIES HTTP FROM ANY TO ANY."
40 deny tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 80 log
50 deny udp 10.42.120.19 0.0.0.0 eq 69 10.38.140.44 0.0.0.0 range 3680 3690 log
60 deny udp 0.0.0.0 255.255.255.255 10.38.99.121 0.0.0.0 log
exit
Indicates all possible
destination IPv4
addresses.
Denies TCP
Port 80 IPv4
traffic to any
destination
from any
source.
Protocol Types
End-of-List
Marker
Source Addresses and
Masks.
Upper entry denies certain
UDP packets from a single
host. Lower entry denies all
UDP packets from all hosts.
Optional Destination
UDP or TCP Operator
and Range of Port
Numbers
In this case, the ACL
specifies UDP port
numbers 3680-3690.
Destination
Address and Mask
ACE Action
(permit or deny)
ACL List Heading with
List Type and ID String
(Name or Number)
Optional Source UDP
or TCP Operator and
Port Number
In this case, the ACL
specifies UDP port 69
packets coming from
the source address.
Remark for ACE at Line 40
ACL Configuration Factors
The Sequence of Entries in an ACL Is Significant
When the switch uses an ACL to determine whether to permit or deny a packet,
it compares the packet to the criteria specified in the individual Access
Control Entries (ACEs) in the ACL, beginning with the first ACE in the list and
proceeding sequentially until a match is found. When a match is found, the
switch applies the indicated action (permit or deny) to the packet. This is
significant because, once a match is found for a packet, subsequent ACEs in
the same ACL will not be applied to that packet, regardless of whether they
match the packet.
9-39

HP PROCURVE 2910AL Specifications

General

Brand	HP
Model	PROCURVE 2910AL
Category	Switch
Language	English