HP E3800 Series, Access Security Manual

Page: 455 / 732

10-75
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Creating or Adding to an Extended, Numbered ACL. This command is
an alternative to using
ip access-list extended < name-str >
and does not use the
Named ACL (
nacl
) context. (For an extended ACL syntax summary, refer to
table on page 10-59.)
Syntax: access-list < 100-199 > < deny | permit > < ip | ip-protocol | ip-protocol-nbr >
< any | host < SA > | SA / mask-length | SA < mask >>
< any | host < DA > | DA /mask-length | DA < mask >>
[ precedence < 0 - 7 | precedence-name >]
[ tos < tos-bit-setting >
[ log ]
If the ACL does not already exist, this command creates the
specified ACL and its first ACE. If the ACL already exists,
the new ACE is appended to the end of the configured list of
explicit ACEs. In the default configuration, the ACEs in an
ACL will automatically be assigned consecutive sequence
numbers in increments of 10 and can be renumbered with
resequence
(page 10-91).
Note: To insert a new ACE between two existing ACEs in
an extended, numbered ACL:
a. Use
ip access list extended < 100 - 199 >
to open the
ACL as a named ACL.
b. Enter the desired sequence number along with the
ACE statement you want.
(Refer to the “Numbered ACLs” list item on page 10-48.)
For a match to occur, a packet must have the source and
destination addressing criteria specified in the ACE, as
well as:
• the protocol-specific criteria configured in the ACE,
including any included, optional elements (described
later in this section)
• any (optional) precedence and/or ToS settings
configured in the ACE
< 100-199 >
Specifies the ACL ID number. The switch interprets a
numeric ACL with a value in this range as an extended
ACL.