IPv4 Access Control Lists (ACLs)

Configuring Extended ACLs

Action

Command(s)

 

Page

 

 

 

Enter or Remove a

ProCurve(config)# ip access-list extended < name-str 100-199 >

9-81

Remark

ProCurve(config-ext-nacl)# [ remark < remark-str> no < 1 - 2147483647 > remark ]

9-83

 

For numbered, extended ACLs only, the following remark commands can be

 

 

substituted for the above:

 

 

ProCurve(config)# access-list < 100 - 199 > remark < remark-str >

 

 

ProCurve(config)# [no] access-list < 100 - 199 > remark

 

 

 

 

Delete an Extended

ProCurve(config)# no ip access-list extended < name-str 100-199 >

9-74

ACL

 

 

 

 

For numbered, extended ACLs only, the following command can also be used:

 

 

ProCurve(config)# no access-list < 100 - 199 >

 

 

 

 

Standard ACLs use only source IPv4 addresses for filtering criteria, extended

 

ACLs use multiple filtering criteria. This enables you to more closely define

 

your IPv4 packet-filtering. Extended ACLs enable filtering on the following:

 

■ Source and destination IPv4 addresses (required), in one of the

 

 

following options:

 

 

•

specific host

 

 

• subnet or group of addresses

 

 

•

any address

 

 

■ choice of any IPv4 protocol

 

 

■ optional packet-type criteria for IGMP, and ICMP traffic

 

■ optional source and/or destination TCP or UDP port, with a further option for comparison operators and (for TCP) an option for estab­ lishing connections

■ filtering for TCP traffic based on whether the subject traffic is initi­ ating a connection (“established” option)

■ optional IP precedence and ToS criteria

The switch allows up to 512 ACLs, and determines the total from the number of unique identifiers in the configuration. For example, configuring two ACLs results in an ACL total of two, even if neither is assigned to an interface. If you then assign a nonexistent ACL to an interface, the new ACL total is three, because the switch now has three unique ACL names in its configuration. (For more on ACL limits, refer to “Monitoring Shared Resources” on page 9-100.)

9-54