HP PROCURVE 2910AL, Access Security Manual

Page: 319 / 594

IPv4 Access Control Lists (ACLs)
Planning an ACL Application
• A group of IPv4 addresses fits the matching criteria. In this case
you provide both the address and the mask. For example:
access-list 1 permit 10.28.32.1 0.0.0.31
Address Mask
10.28.32.1 0.0.0.31
This policy states that:
–
In the first three octets of a packet’s SA, every bit must be set the
same as the corresponding bit in the SA defined in the ACE.
– In the last octet of a packet’s SA, the first three bits must be the
same as in the ACE, but the last five bits are wildcards and can
be any value.
■ Unlike subnet masks, the wildcard bits in an ACL mask need not be
contiguous. For example, 0.0.7.31 is a valid ACL mask. However, a
subnet mask of 255.255.248.224 is not a valid subnet mask.
Example of How the Mask Bit Settings Define a Match . Assume an
ACE where the second octet of the mask for an SA is 7 (the rightmost three
bits are “on”, or “1”) and the second octet of the corresponding SA in the ACE
is 31 (the rightmost five bits). In this case, a match occurs when the second
octet of the SA in a packet being filtered has a value in the range of 24 to 31.
Refer to table 9-1, below.
Table 9-1. Example of How the Mask Defines a Match
Location of Octet Bit Position in the Octet
128 64 32 16 8 4 2 1
SA in ACE
Mask for SA
Corresponding Octet of a Packet’s
SA
0
0
0
0
0
0
1
0
1
0
1
1
0/1
1
1
0/1
1
1
0/1 0 0 0 1 1
The shaded area indicates bits in the packet that must exactly match the bits in the source
address in the ACE. Wherever the mask bits are ones (wildcards), the corresponding address
bits in the packet can be any value, and where the mask bits are zeros, the corresponding
address bits in the packet must be the same as those in the ACE.
Note: This example covers
only one octet of an IPv4 address. An actual ACE applies this method to all four octets of the
address.
Example of Allowing Only One IPv4 Address (“Host” Option). Sup­
pose, for example, that you have configured the ACL in figure 9-5 to filter
inbound packets on VLAN 20. Because the mask is all zeros, the ACE policy
9-31