HP 6400cl, Management Manual, Page: 417 / 664

Access Control Lists (ACLs) for the Series 3400cl and Series 6400cl Switches
Terminology
ACL Mask: Follows an IP address (source or destination) listed in an ACE to
specify either a subnet or a group of devices. Defines which bits in a
packet’s corresponding IP addressing must exactly match the IP address­
ing in the ACE, and which bits need not match (wildcards). For example:
Dotted-Decimal and CIDR
versions of the same mask. In both
cases, zeros in the mask indicate
significant digits. Ones in the mask
indicate wildcard digits.
As shown above, zeros in an ACL mask specify an exact match require­
ment for IP addresses, and ones specify a wildcard. In this example, a
matching IP address would be any address in the range 10.10.10.1-255.
(See also “How an ACE Uses a Mask To Screen Packets for Matches” on
page 10-30, and Per-Port Mask on page 10-8.)
DA: The acronym for Destination IP Address . In an IP packet, this is the
destination IP address carried in the header, and identifies the destination
intended by the packet’s originator. In an extended ACE, this is the second
of two IP addresses required by the ACE to determine whether there is a
match between a packet and the ACE. See also “SA”.
Deny: An ACE configured with this action causes the switch to drop an
inbound packet for which there is a match within an applicable ACL. As
an option, you can configure the switch to generate a logging output to a
Syslog server and a console session.)
Extended ACL: This type of Access Control List uses layer-3 IP criteria
composed of source and destination IP addresses and (optionally) TCP
or UDP port criteria to determine whether there is a match with an IP
packet. You can apply extended ACLs to either inbound or outbound
routed traffic and to any inbound switched or routed traffic with a DA
belonging to the switch itself. Extended ACLs require an identification
number (ID) in the range of 100 - 199 or an alphanumeric name.
Implicit Deny: If the switch finds no matches between an inbound packet
and the configured criteria in an applicable ACL, then the switch denies
(drops) the packet with an implicit “deny IP any” operation. You can
preempt the implicit “deny IP any” in a given ACL by configuring
permit
any
(standard) or
permit IP any any
(extended) as the last explicit ACE in
the ACL. Doing so permits an inbound packet that is not explicitly permit­
ted or denied by other ACEs configured sequentially earlier in the ACL.
Unless otherwise noted, “implicit deny IP any” refers to the “deny” action
enforced by both standard and extended ACLs.
10-7