IPv4 Access Control Lists (ACLs)

Configuring and Assigning an IPv4 ACL

For example, figure 9-9shows how to interpret the entries in an extended ACL.

ProCurve(config)# show running

ACL List Heading with

List Type and ID String

Running configuration:

(Name or Number)

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

; J9146A Configuration Editor;

on release #W.14.XX

Indicates all possible

destination IPv4

 

 

Protocol Types

 

 

 

 

 

 

 

 

 

addresses.

hostname "ProCurve"

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Denies TCP

ip access-list

extended "Sample-List-1"

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Port 80 IPv4

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

traffic to any

10

permit

ip

10.38.130.55 0.0.0.0 10.38.130.240 0.0.0

 

 

 

 

 

 

 

 

destination

20

permit

tcp

0.0.0.0 255.255.255.255 0.0.0.0 255.

255.255 eq 23

from any

30

remark "ALLOWS HTTP FROM SINGLE HOST."

 

 

 

 

 

source.

30

permit tcp 10.38.131.14 0.0.0.0 eq 80

 

 

 

 

eq 3871

0.0.0.0 255.255.255.255

40

remark "DENIES HTTP FROM ANY TO ANY."

 

Remark for ACE at Line 40

 

 

 

 

 

 

 

 

 

40

deny tcp 0.0.0.0 255.255.255.255 0.0.0.0

255.255.255.255

eq 80 log

50 deny udp 10.42.120.19 0.0.0.0 eq 69 10.38.140.44 0.0.0.0range 3680 3690 log

60 deny udp 0.0.0 0 255.255.255.255 10.38.99. 0.0.0.0 log exit

End-of-List

Marker

ACE Action

(permit or deny)

Source Addresses and

Masks.

Upper entry denies certain UDP packets from a single host. Lower entry denies all UDP packets from all hosts.

Optional Source UDP

or TCP Operator and

Port Number

In this case, the ACL specifies UDP port 69 packets coming from the source address.

Destination

 

Optional Destination

Address and Mask

 

UDP or TCP Operator

 

 

and Range of Port

 

 

Numbers

 

 

In this case, the ACL

 

 

specifies UDP port

 

 

numbers 3680-3690.

Figure 9-9. Example of a Displayed Extended ACL ConfigurationACL Configuration Factors

The Sequence of Entries in an ACL Is Significant

When the switch uses an ACL to determine whether to permit or deny a packet, it compares the packet to the criteria specified in the individual Access Control Entries (ACEs) in the ACL, beginning with the first ACE in the list and proceeding sequentially until a match is found. When a match is found, the switch applies the indicated action (permit or deny) to the packet. This is significant because, once a match is found for a packet, subsequent ACEs in the same ACL will not be applied to that packet, regardless of whether they match the packet.

9-39