HP E3800 Series, Access Security Manual

Page: 508 / 732

10-128
IPv4 Access Control Lists (ACLs)
General ACL Operating Notes
General ACL Operating Notes
ACLs do not provide DNS hostname support. ACLs cannot be config-
ured to screen hostname IPv4 traffic between the switch and a DNS.
ACLs Do Not Affect Serial Port Access. ACLs do not apply to the
switch’s serial port.
ACL Screening of IPv4 Traffic Generated by the Switch. Outbound
RACL applications on a switch do not screen IPv4 traffic generated by the
switch itself (such as broadcasts, Telnet, Ping, and ICMP replies). Note that
ACLs applied on the switch do screen this type of IPv4 traffic when other
devices generate it. Similarly, ACL applications can screen responses from
other devices to unscreened IPv4 traffic the switch generates.
ACL Logging.
• The ACL logging feature generates a message only when packets are
explicitly denied as the result of a match, and not when explicitly
permitted or implicitly denied. To help test ACL logging, configure the
last entry in an ACL as an explicit
deny
statement with a
log
statement
included, and apply the ACL to an appropriate VLAN.
• Logging enables you to selectively test specific devices or groups.
However, excessive logging can affect switch performance. For this
reason, HP recommends that you remove the logging option from
ACEs for which you do not have a present need. Also, avoid config-
uring logging where it does not serve an immediate purpose. (Note
that ACL logging is not designed to function as an accounting
method.) See also “Apparent Failure To Log All ‘Deny’ Matches” in the
section titled “ACL Problems”, found in appendix C, “Troubleshoot-
ing” of the
Management and Configuration Guide for your switch.
• When configuring logging, you can reduce excessive resource use by
configuring the appropriate ACEs to match with specific hosts instead
of entire subnets. (For more on resource usage, refer to
“Monitoring
Shared Resources” on page 10-129.)
Minimum Number of ACEs in an ACL. Any ACL must include at least one
ACE to enable IP traffic screening. A numbered ACL cannot be created
without at least one ACE. A named ACL can be created “empty”; that is,
without any ACEs. However in an empty ACL applied to an interface, the
Implicit Deny function does not operate, and the ACL has no effect on traffic.