HP PROCURVE 2910AL, Access Security Manual

Page: 350 / 594

IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Port Number or Well-Known Port Name:
Use the TCP or UDP port number required by your appli­
cation. The switch also accepts these well-known TCP or
UDP port names as an alternative to their port numbers:
• TCP : bgp, dns, ftp, http, imap4, ldap, nntp, pop2, pop3, smtp, ssl,
telnet
• UDP : bootpc, bootps, dns, ntp, radius, radius-old, rip, snmp,
snmp-trap, tftp
To list the above names, press the
[Shift] [?]
key combination
after entering an operator. For a comprehensive listing of
port numbers, visit www.iana.org/assignments/port­
numbers.
[ comparison - operator < tcp-dest-port >] [established]
[ comparison - operator < udp-dest-port >]
This option, if used, is entered immediately after the <
DA
>
entry. To specify a TCP or UDP port number, (1) select a
comparison operator and (2) enter the port number or a well-
known port name.
Comparison Operators and Well-Known Port Names —
These are the same as are used with the TCP/UDP source-port
options, and are listed earlier in this command description.
[established] —
This option applies only where TCP is the
configured protocol type. It blocks the synchronizing packet
associated with establishing a TCP connection in one direction
on a VLAN while allowing all other IPv4 traffic for the same
type of connection in the opposite direction. For example, a
Telnet connect requires TCP traffic to move both ways between
a host and the target device. Simply applying a Deny to inbound
Telnet traffic on a VLAN would prevent Telnet sessions in either
direction because responses to outbound requests would be
blocked. However, by using the
established
option, inbound
Telnet traffic arriving in response to outbound Telnet requests
would be permitted, but inbound Telnet traffic trying to estab­
lish a connection would be denied.
9-62