HP E3800 Series, Access Security Manual

Page: 386 / 732

10-6
IPv4 Access Control Lists (ACLs)
Overview of Options for Applying IPv4 ACLs on the Switch
Command Summary for IPv4 Extended ACLs
Action Command(s) Page
Create an Extended,
Named ACL
or
Add an ACE to the End
of an Existing,
Extended ACL
HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-std-nacl)# < deny | permit >
< ip | ip-protocol | ip-protocol-nbr >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
< tcp | udp >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
[ comparison - operator < value >]
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ comparison - operator < value >]
[established]
[ack] [fin] [rst] [syn]
2
< igmp >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ igmp-packet-type ]
< icmp >
< any | host < SA > | SA /< mask-length > | SA < mask >>
1
< any | host < DA > | DA /< mask-length > | DA < mask >>
1
[ [< 0 - 255 > [ 0 - 255 ] ] | icmp-message ]
[precedence < priority >]
[tos < tos- setting >]
[log]
2
10-61
Create an Extended,
Numbered ACL
or
Add an ACE to the End
of an Existing,
Numbered ACL
HP Switch(config)# access-list < 100-199 > < deny | permit >
< ip-options | tcp/udp-options | igmp-options | icmp-options >
[precedence < priority >]
[tos < tos- setting >]
[log]
2
Note:
Uses the same IP, TCP/UDP, IGMP, and ICMP options as shown above for
“Create an Extended, Named ACL”.
10-74
Insert an ACE by
Assigning a Sequence
Number HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-ext-nacl)# 1-2147483647 < deny | permit >
Uses the options shown above for “Create an Extended, Named ACL”.
10-88
Delete an ACE by
Specifying Its
Sequence Number HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-std-nacl)# no < 1-2147483647 >
10-90
Resequence the ACEs
in an ACL HP Switch(config)# ip access-list resequence < name-str | 100-199 >
< 1-2147483647 > < 1-2147483646 >
10-91
1
The mask can be in either dotted-decimal notation (such as 0.0.15.255) or CIDR notation (such as /20).
2
TCP flag (control bit) options for destination TCP.
3
The [ log ] function applies only to “deny” ACLs, and generates a message only when there is a “deny” match.