Installation and Getting Started Guide

The fourth entry denies all IP traffic from host 209.157.21.100to host 209.157.22.1 and generates Syslog entries for packets that are denied by this entry.

The fifth entry denies all OSPF traffic and generates Syslog entries for denied traffic.

The sixth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.

The following commands apply ACL 102 to the incoming and outgoing traffic on port 1/2 and to the incoming traffic on port 4/3.

HP9300(config)# int eth 1/2

HP9300(config-if-1/2)# ip access-group 102 in

HP9300(config-if-1/2)# ip access-group 102 out

HP9300(config-if-1/2)# exit

HP9300(config)# int eth 4/3

HP9300(config-if-4/3)# ip access-group 102 in

HP9300(config)# write memory

Here is another example of an extended ACL.

HP9300(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 HP9300(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24 HP9300(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 lt telnet neq 5

HP9300(config)# access-list 103 deny udp any range 5 6 209.157.22.0/24 range 7 8 HP9300(config)# access-list 103 permit any any

The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network.

The second entry denies all FTP traffic from the 209.157.21.x network to the 209.157.22.x network.

The third entry denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if the TCP port number of the traffic is less than the well-known TCP port number for Telnet (23), and if the TCP port is not equal to 5. Thus, TCP packets whose TCP port numbers are 5 or are greater than 23 are allowed.

The fourth entry denies UDP packets from any source to the 209.157.22.x network, if the UDP port number from the source network is 5 or 6 and the destination UDP port is 7 or 8.

The fifth entry permits all packets that are not explicitly denied by the other entries. Without this entry, the ACL would deny all incoming or outgoing IP traffic on the ports to which you assign the ACL.

The following commands apply ACL 103 to the incoming and outgoing traffic on ports 2/1 and 2/2.

HP9300(config)# int eth 2/1

HP9300(config-if-2/1)# ip access-group 103 in

HP9300(config-if-2/1)# ip access-group 103 out

HP9300(config-if-2/1)# exit

HP9300(config)# int eth 2/2

HP9300(config-if-2/2)# ip access-group 103 in

HP9300(config-if-2/2)# ip access-group 103 out

HP9300(config)# write memory

Filtering on IP Precedence and TOS Values

To configure an extended IP ACL that matches based on IP precedence, enter commands such as the following:

HP9300(config)# access-list 103 deny tcp 209.157.21.0/24 209.157.22.0/24 precedence internet

HP9300(config)# access-list 103 deny tcp 209.157.21.0/24 eq ftp 209.157.22.0/24 precedence 6

HP9300(config)# access-list 103 permit any any

The first entry in this ACL denies TCP traffic from the 209.157.21.x network to the 209.157.22.x network, if the traffic has the IP precedence option “internet” (equivalent to “6”).

3 - 10