HP PROCURVE 2910AL, Access Security Manual

Page: 315 / 594

IPv4 Access Control Lists (ACLs)
Planning an ACL Application
■ Generally, you should list ACEs from the most specific (individual
hosts) to the most general (subnets or groups of subnets) unless doing
so permits traffic that you want dropped. For example, an ACE
allowing a small group of workstations to use a specialized printer
should occur earlier in an ACL than an entry used to block widespread
access to the same printer.
IPv4 ACL Configuration and Operating Rules
■ Static Port ACLs: A static port ACL filters traffic entering the switch
on the port(s) or trunk(s) to which it is assigned.
■ Per Switch ACL Limits for All ACL Types. At a minimum an ACL
must have one, explicit “permit” or “deny” Access Control Entry. You
can configure up to 512 ACLs. For IPv4 ACLs, the maximums are as
follows:
• Named (Extended or Standard) ACLs: Up to 512 (minus any numeric
standard or extended ACL assignments)
• Numeric Standard ACLs: Up to 99; numeric range: 1 - 99
• Numeric Extended ACLs: Up to 100; numeric range: 100 - 199
• The maximum number of ACEs supported by the switch is up to 1024
for IPv4 ACEs. The maximum number of ACEs allowed on a port
depends on the concurrent resource usage by multiple configured
features. For more information, use the
show < qos | access-list >
resources command and/or refer to “Monitoring Shared Resources”
on page 9-100.
■ Implicit Deny: In any static IPv4 ACL, the switch automatically
applies an implicit deny ip any that does not appear in show listings.
This means that the ACL denies any IPv4 packet it encounters that
does not have a match with an entry in the ACL. Thus, if you want an
ACL to permit any packets that you have not expressly denied, you
must enter a
permit any or permit ip any any as the last ACE in an ACL.
Because, for a given packet the switch sequentially applies the ACEs
in an ACL until it finds a match, any packet that reaches the
permit any
or permit ip any any entry will be permitted, and will not encounter the
deny ip any ACE the switch automatically includes at the end of the
ACL. For an example, refer to figure 9-4 on page 9-23. For Implicit
Deny operation in dynamic ACLs, refer to chapter 6, “Configuring
RADIUS Server Support for Switch Services”
9-27