HP ProCurve W.14.03 Figure 9-3.The Packet-FilteringProcess in an ACL with N Entries (ACEs)

IPv4 Access Control Lists (ACLs)

IPv4 Static ACL Operation

Test a packet against criteria in first ACE.

Is there a	Yes
		Perform action	End
match?		(permit or deny).

No

Test the packet against criteria in second ACE.

Is there a		Yes	Perform action
				End
match?			(permit or deny).
	No
Test packet against
criteria in Nth ACE.
		Yes
Is there a			Perform action
				End
match?			(permit or deny).
	No
Deny the packet		End
(invoke an Implicit
Deny).

1.If a match is not found with the first ACE in an ACL, the switch proceeds to the next ACE and so on.

2.If a match with an explicit ACE is subsequently found, the packet is either permit­ ted (forwarded) or denied (dropped), depending on the action specified in the matching ACE. In this case the switch ignores all sub­ sequent ACEs in the ACL.

3.If a match is not found with any explicit ACE in the ACL, the switch invokes the Implicit Deny at the end of every ACL, and drops the packet.

Note: If the list includes an ACE configured with Permit Any forwarding, no packets can reach the Implicit Deny at the end of the list. Also, placing an ACE with Permit Any forwarding at any point in an ACL defeats the purpose of any subsequent ACEs in the list.

	Figure 9-3. The Packet-Filtering Process in an ACL with N Entries (ACEs)
Note		The order in which an ACE occurs in an ACL is significant. For example, if an
		ACL contains six ACEs, but the first ACE allows Permit Any forwarding, then
		the ACL permits all IPv4 traffic, and the remaining ACEs in the list do not
		apply, even if they specify criteria that would make a match with any of the
		traffic permitted by the first ACE.
		For example, suppose you want to configure an ACL on the switch (with an
		ID of “Test-02”) to invoke these policies for routed traffic entering the switch:

9-22