HP 6400cl, Management Manual, Page: 370 / 664

Access Control Lists (ACLs) for the Series 5300xl Switches
Planning an ACL Application
Examples Allowing Multiple IP Addresses. Table 9-3 provides examples
of how to apply masks to meet various filtering requirements.
Table 9-3. Example of Using an IP Address and Mask in an Access Control Entry
IP Address in the ACE Mask Policy for a Match Between a
Packet and the ACE Allowed IP Addresses
A: 18.38.252.195 0.0.0.255 Exact match in first three
octets only. 18.38.252.< 0-255 >
(See row A in table 9-4, below.)
B: 18.38.252.195 0.0.7.255 Exact match in the first two
octets and the leftmost five bits
(248) of the third octet. 18.38.< 248-255 >.< 0-255 >
(In the third octet, only the rightmost three bits are
wildcard bits. The leftmost five bits must be a
match, and in the ACE, these bits are all set to 1. See
row B in table 9-4, below.)
C: 18.38.252.195 0.0.0.0 Exact match in all octets. 18.38.252.195
(There are no wildcard bits in any of the octets. See
row C in table 9-4, below.)
D: 18.38.252.195 0.15.255.255 Exact match in the first octet
and the leftmost four bits of the
second octet.
18.< 32-47 >.< 0-255 >.<0-255>
(In the second octet, the rightmost four bits are
wildcard bits. See row D in table 9-4, below.)
Table 9-4. Mask Effect on Selected Octets of the IP Addresses in Table 9-3
IP Octet Mask Octet 128 64 32 16 8 4 2
Addr Range
A 0
all bits
252 1 1 1 1 1 1 0 0
B 7
last 3 bits
248-255 1 1 1 1 1 0 or 1 0 or 1 0 or 1
C 0
all bits
195 1 1 0 0 0 0 1 1
D 15
last 4 bits
32-47 0 0 1 0 0 or 1 0 or 1 0 or 1 0 or 1
3
3
4
2
Shaded areas indicate bit settings that must be an exact match.
If there is a match between the policy in the ACE and the IP address in a packet,
then the packet is either permitted or denied, according to how the ACE is
configured. If there is not a match, the next ACE in the ACL is then applied to
the packet. The same operation applies to a destination IP address (DA) used
in an extended ACE. (Where an ACE includes both source and destination IP
addresses, there is one IP-address/ACL-mask pair for the source address, and
another IP-address/ACL-mask pair for the destination address. See “Configur­
ing and Assigning an ACL” on page 9-25.)
CIDR Notation. For information on using CIDR notation to specify ACL
masks, refer to “Using CIDR Notation To Enter the ACL Mask” on page 9-32.
9-24
1