HP HP ProCurve Series 6600, Access Security Manual

Page: 487 / 778

10-67
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Options for TCP and UDP Traffic in Extended ACLs. An ACE designed
to permit or deny TCP or UDP traffic can optionally include port number
criteria for either the source or destination, or both. Use of TCP criteria also
allows the
established
option for controlling TCP connection traffic. (For a
summary of the extended ACL syntax options, refer to table on page 10-59.)
Syntax: < deny | permit > tcp
<
SA > [ comparison - operator < tcp - src-port >]
< DA > [ comparison - operator < tcp-dest-port >]
[established]
[ ack ] [ fin ]
[ rst ] [ syn ]
Syntax: < deny | permit > udp
<
SA > [ comparison - operator < udp - src-port >]
< DA > [ comparison - operator < udp-dest-port >]
In an extended ACL using either
tcp
or
udp
as the packet protocol
type, you can optionally use TCP or UDP source and/or desti-
nation port numbers or ranges of numbers to further define the
criteria for a match. For example:
#
deny tcp host 10.20.10.17 eq 23 host 10.20.10.155
established
#permit tcp host 10.10.10.100 host 10.20.10.17
eq telnet
#deny udp 10.30.10.1/24 host 10.20.10.17 range
161 162
[ comparison - operator < tcp/udp - src-port >]
To specify a TCP or UDP source port number in an ACE, (1)
select a comparison operator from the following list and (2)
enter the port number or a well-known port name.