HP HP ProCurve Series 6600, Access Security Manual

Page: 430 / 778

10-10
IPv4 Access Control Lists (ACLs)
Terminology
ACLs). You can preempt the Implicit Deny in a given ACL by configuring
a
permit any
(standard) or
permit ip any any
(extended) as the last explicit
ACE in the ACL. Doing so permits any IPv4 packet that is not explicitly
permitted or denied by other ACEs configured sequentially earlier in the
ACL. Unless otherwise noted, Implicit Deny refers to the “deny” function
enforced by both standard and extended ACLs.
Inbound Traffic: For the purpose of defining where the switch applies IPv4
ACLs to filter traffic, inbound traffic is a packet that meets one of the
following criteria:
• Routed ACL (RACL): Inbound traffic is a packet entering the switch
on a VLAN interface (or a subnet in a multinetted VLAN) with a
destination IPv4 address (DA) that is for any of the following:
–
an external device on a different VLAN or subnet than the inter-
face on which it arrived
– an IPv4 address configured on the switch itself
– a broadcast
Note that, except for IPv4 traffic addressed to the switch itself, and
outbound IPv4 traffic generated by the switch, routing must be con-
figured on the switch to enable support for RACL applications.
• VLAN ACL (VACL): Inbound traffic is a packet entering the switch on
a VLAN interface (or a subnet in a multinetted VLAN).
• Static Port ACL: Inbound traffic is a packet entering the switch on the
port.
• RADIUS-Assigned ACL: Where a RADIUS server has authenticated a
client and assigned an ACL to the port to filter the client’s IPv4 traffic,
inbound traffic is a packet entering the switch from that client.
NAME-STR
: A term used in extended ACL syntax statements to represent the
“name string”; the alphanumeric string used to identify the ACL. See also
IDENTIFIER
and ACL-ID .
Named ACL: An ACL created with the
ip access-list < extended | standard >
< name-str >
command and then populated using the
< deny | permit >
command in the Named ACL (
nacl
) CLI context. (Refer to “Entering the
IPv4 “Named ACL” (
nacl
) Context” on page 10-52.)
Numbered ACL: An ACL created and initially populated by using the
access-
list < extended < 100 - 199 > | standard > < 1-99 >>
command. (Refer to
“Creating or Adding to an Standard, Numbered ACL” on page 10-56.) After
a numbered ACL has been created, the switch manages it in the same way
as a named ACL, meaning that it can be applied and edited in the same
way as a named ACL.