HP PROCURVE 2910AL, Access Security Manual

Page: 312 / 594

IPv4 Access Control Lists (ACLs)
Planning an ACL Application
Planning an ACL Application
Before creating and implementing ACLs, you need to define the policies you
want your ACLs to enforce, and understand how the ACL assignments will
impact your network users.
N o t e
All IPv4 traffic entering the switch on a given interface is filtered by all ACLs
configured for inbound traffic on that interface. For this reason, an inbound
IPv4 packet will be denied (dropped) if it has a match with either an implicit
or explicit
deny
in any of the inbound ACLs applied to the interface.
(Refer to “Multiple ACLs on an Interface” on page 9-16.)
IPv4 Traffic Management and Improved Network
Performance
You can use ACLs to block traffic from individual hosts, workgroups, or
subnets, and to block access to VLANs, subnets, devices, and services. Traffic
criteria for ACLs include:
■ Switched and/or routed traffic
■ Any traffic of a specific IPv4 protocol type (0-255)
■ Any TCP traffic (only) for a specific TCP port or range of ports,
including optional control of connection traffic based on whether the
initial request should be allowed
■ Any UDP traffic or UDP traffic for a specific UDP port
■ Any ICMP traffic or ICMP traffic of a specific type and code
■ Any IGMP traffic or IGMP traffic of a specific type
■ Any of the above with specific precedence and/or ToS settings
Answering the following questions can help you to design and properly
position IPv4 ACLs for optimum network usage.
9-24