HP W.14.03 13

IPv4 Static ACL Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20

The Packet-filtering Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-20

Planning an ACL Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-24
IPv4 Traffic Management and Improved Network Performance	. . . 9-24
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-25
Guidelines for Planning the Structure of a Static ACL . . . . . . . . .	. . . 9-26
IPv4 ACL Configuration and Operating Rules . . . . . . . . . . . . . . . .	. . . 9-27
How an ACE Uses a Mask To Screen Packets for Matches . . . . .	. . . 9-28
What Is the Difference Between Network (or Subnet)
Masks and the Masks Used with ACLs? . . . . . . . . . . . . . . . . .	. . . 9-28
Rules for Defining a Match Between a Packet and an
Access Control Entry (ACE) . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-29
Configuring and Assigning an IPv4 ACL . . . . . . . . . . . . . . . . . . . .	. . . 9-34
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-34
General Steps for Implementing ACLs . . . . . . . . . . . . . . . . . .	. . . 9-34
Options for Permit/Deny Policies . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-35
ACL Configuration Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-35
Standard ACL Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-36
Extended ACL Configuration Structure . . . . . . . . . . . . . . . . .	. . . 9-37
ACL Configuration Factors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-39
The Sequence of Entries in an ACL Is Significant . . . . . . . . .	. . . 9-39
Allowing for the Implied Deny Function . . . . . . . . . . . . . . . . .	. . . 9-41
A Configured ACL Has No Effect Until You Apply It
to an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	. . . 9-41

You Can Assign an ACL Name or Number to an Interface

Even if the ACL Does Not Exist in the Switch’s Configuration . 9-41

Using the CLI To Create an ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	9-42
General ACE Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .	9-42
Using CIDR Notation To Enter the IPv4 ACL Mask . . . . . . . . . .	9-43