HP 3400CL-24G manual Packet-Filtering Process in an ACL with N Entries ACEs

Enhancements

Release M.10.02 Enhancements

Test packet against criteria in first ACE.

1.	If a match is not found with
	the first ACE in an ACL, the
	switch proceeds to the next
	ACE and so on.
2.	If a match with an explicit

Is there a

match?

Yes

Perform action (permit or deny).

End

ACE is subsequently found,

the packet is either permit-

ted (forwarded) or denied

(dropped), depending on

No

Test the packet against criteria in second ACE.

the action specified in the

matching ACE. In this case

the switch ignores all sub-

sequent ACEs in the ACL.

3. If a match is not found with

any explicit ACE in the ACL,

Is there a

match?

No

Test packet against criteria in Nth ACE.

Is there a

match?

No

Deny the packet (invoke implicit deny any).

Yes	Perform action
	(permit or deny).

Yes	Perform action
	(permit or deny).
End

End

End

the switch invokes the

implicit deny IP any at the

end of every ACL, and

drops the packet.

Note: If the list includes a permit IP any entry, no packets can reach the implicit deny IP any at the end of the list. Also, a permit IP any ACE at any point in an ACL defeats the purpose of any subsequent ACEs in the list.

Figure 4. The Packet-Filtering Process in an ACL with N Entries (ACEs)

N o t e

The order in which an ACE occurs in an ACL is significant. For example, if an ACL contains six ACEs, but the first ACE is a “permit IP any”, then the ACL permits all IP traffic from the authenticated client, and the remaining ACEs in the list do not apply, even if they specify criteria that would make a match with any of the traffic permitted by the first ACE.

52