HP HP ProCurve Series 6600, Access Security Manual

Page: 442 / 778

10-22
IPv4 Access Control Lists (ACLs)
Overview
Features Common to All ACL Applications
■ Any ACL can have multiple entries (ACEs).
■
You can apply any one ACL to multiple interfaces.
■ All ACEs in an ACL configured on the switch are automatically
sequenced (numbered). For an existing ACL, entering an ACE without
specifying a sequence number automatically places the ACE at the
end of the list. Specifying a sequence number inserts the ACE into the
list at the specified sequential location.
• Automatic sequence numbering begins with “10” and increases in
increments of 10. You can renumber the ACEs in an ACL and also
change the sequence increment between ACEs.
• The CLI
remark
command option allows you to enter a separate
comment for each ACE.
■ A source or destination IPv4 address and a mask, together, can define
a single host, a range of hosts, or all hosts.
■ Every ACL populated with one or more explicit ACEs includes an
Implicit Deny as the last entry in the list. The switch applies this action
to any packets that do not match other criteria in the ACL. (For
standard ACLs, the Implicit Deny is
deny any . For extended ACLs, it
is deny ip any any .)
■ In any ACL, you can apply an ACL log function to ACEs that have an
explicit “deny” action. The logging occurs when there is a match on
a “deny” ACE. The switch sends ACL logging output to Syslog, if
configured, and, optionally, to a console session. (In software releases
earlier than K.14.01 that support ACL use for mirroring, logging does
not occur when there is a match on a “deny” ACE in an ACL used for
mirroring.)
You can create ACLs for the switch configuration using either the CLI or a text
editor. The text-editor method is recommended when you plan to create or
modify an ACL that has more entries than you can easily enter or edit using
the CLI alone. Refer to “Creating or Editing ACLs Offline” on page 10-107.