HP E3800 Series, Access Security Manual

Page: 422 / 732

10-42
IPv4 Access Control Lists (ACLs)
Configuring and Assigning an IPv4 ACL
3. One or more deny/permit list entries (ACEs): One entry per line.
4. Implicit Deny: Where an ACL is in use, it denies any packets that do not
have a match with the ACEs explicitly configured in the list. The Implicit
Deny does not appear in ACL configuration listings, but always functions
when the switch uses an ACL to filter packets. (You cannot delete the
Implicit Deny, but you can supersede it with a
permit any or permit ip any
any statement.)
Standard ACL Structure
Individual ACEs in a standard ACL include only a permit/deny statement, the
source addressing, and an optional
log command (available with “deny”
statements).
Figure 10-9. Example of the General Structure for a Standard ACL
Element Notes
Type Standard or Extended
Identifier • Alphanumeric; Up to 64 Characters, Including
Spaces
• Numeric: 1 - 99 (Standard) or 100 - 199 (Extended)
Remark Allows up to 100 alphanumeric characters, including
blank spaces. (If any spaces are used, the remark
must be enclosed in a pair of single or double
quotes.) A remark is associated with a particular ACE
and will have the same sequence number as the ACE.
(One remark is allowed per ACE.) Refer to “Attaching
a Remark to an ACE” on page 10-92.
Maximum ACEs Per per Switch The upper limit on ACEs supported by the switch
depends on the concurrent resource usage by
configured ACL, QoS, IDM, Mirroring, virus-
throttling, and other features. Refer to “Monitoring
Shared Resources” on page 10-129.
ip access-list standard < identifier >"
[ [ seq-# ] remark < remark-str >]
< permit | deny > < SA > [log]
.
.
.
< Implicit Deny >
exit
Note: The optional log
function is available only
for explicit “deny” ACEs.