453
Implementing time-based ACL rules
You can implement ACL rules based on the time of day by applying a time range to the rules. A
time-based ACL rule takes effect only in a time period specified by the time range.
The following types of time range are available:
•
Periodic time range
—Recurs periodically on a day or days of the week.
•
Absolute time range
—Represents only a period of time and does not recur.
IPv4 fragments filtering with ACLs
Traditional packet filtering matches only first fragments of IPv4 packets, and allows all subsequent
non-first fragments to pass through. Attackers can fabricate non-first fragments to attack networks.
To avoid risks, the HP ACL implementation filters all fragments based on Layer 3 attributes.
Configuration guidelines
When you configure an ACL, follow these guidelines:
•
You cannot add a rule with, or modify a rule to have, the same permit/deny statement as an
existing rule in the ACL.
•
You can only modify the existing rules of an ACL that uses the match order of
config
. When
modifying a rule of such an ACL, you may choose to change just some of the settings, in which case
the other settings remain the same.
ACL configuration procedures
IPv4 ACL configuration procedure
Step
Remarks
1.
Configuring a time range.
Optional.
Add a time range. A rule referencing a time range
takes effect only during the specified time range.
2.
Adding an IPv4 ACL.
Required.
Add an IPv4 ACL. The category of the added ACL
depends on the ACL number that you specify.
3.
Configuring a rule for a basic IPv4 ACL.
Required.
Complete one of the tasks according to the ACL
category.
4.
Configuring a rule for an advanced IPv4 ACL.
5.
Configuring a rule for an Ethernet frame header
ACL.
Summary of Contents for HP 830 Series
Page 37: ...25 Figure 18 Configuration complete ...
Page 70: ...58 Figure 49 Displaying the rate settings of ports ...
Page 78: ...66 Figure 56 Configuring the monitor port ...
Page 82: ...70 Figure 59 Switching to the management level ...
Page 87: ...75 Figure 64 Displaying port traffic statistics ...
Page 167: ...155 Figure 154 Displaying the current voice VLAN information ...
Page 304: ...292 Figure 280 Traceroute operation result ...
Page 321: ...309 Request timed out Ping statistics for 10 0 0 1 Packets Sent 4 Received 0 Lost 4 100 loss ...
Page 343: ...331 Figure 330 Ping operation summary ...