HP E3800 Series, Access Security Manual

Page: 418 / 732

10-38
IPv4 Access Control Lists (ACLs)
Planning an ACL Application
Example of How the Mask Bit Settings Define a Match . Assume an
ACE where the second octet of the mask for an SA is 7 (the rightmost three
bits are “on”, or “1”) and the second octet of the corresponding SA in the ACE
is 31 (the rightmost five bits). In this case, a match occurs when the second
octet of the SA in a packet being filtered has a value in the range of 24 to 31.
Refer to table 10-2, below.
Table 10-2. Example of How the Mask Defines a Match
Example of Allowing Only One IPv4 Address (“Host” Option). Sup-
pose, for example, that you have configured the ACL in figure 10-8 to filter
inbound packets on VLAN 20. Because the mask is all zeros, the ACE policy
dictates that a match occurs only when the source address on such packets
is identical to the address configured in the ACE.
Figure 10-8. Example of an ACL with an Access Control Entry (ACE) that Allows Only One Source Address
Location of Octet Bit Position in the Octet
128 64 32 16 8 4 2 1
SA in ACE 0 0 0 1 1 1 1 1
Mask for SA 0 0 0 0 0 1 1 1
Corresponding Octet of a Packet’s
SA 0 0 0 1 1 0/1 0/1 0/1
The shaded area indicates bits in the packet that must exactly match the bits in the source
address in the ACE. Wherever the mask bits are ones (wildcards), the corresponding address
bits in the packet can be any value, and where the mask bits are zeros, the corresponding
address bits in the packet must be the same as those in the ACE.
Note: This example covers
only one octet of an IPv4 address. An actual ACE applies this method to all four octets of the
address.
ip access-list standard Fileserver
permit 10.28.252.117 0.0.0.0
exit
Inbound Packet “A” On VLAN 20
– Destination Address: 10.35.248.184
– Source Address: 10.28.252.117
Inbound Packet “B” On VLAN 20
– Destination Address: 10.35.248.184
– Source Address: 10.28.252.120
This ACL (a standard ACL named “Fileserver”) includes an ACE (Access Control Entry)
that permits matches only with the packets received from 10.28.252.117 (the SA).
Packets from any other source do not match and are denied.
Source Address (SA)
Mask (All zeros mean that a match occurs
only when a packet’s source address is
identical to the source address configured
in the ACE.
The VLAN permits packet “A”
because its source address matches
the source address in the ACE.
The VLAN denies packet “B”
because its source address does not
match the source address in the ACE.
ACE