HP PROCURVE 2910AL, Access Security Manual

Page: 359 / 594

IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Additional Options for TCP and UDP Traffic. An ACE designed to per­
mit or deny TCP or UDP traffic can optionally include port number criteria
for either the source or destination, or both. Use of TCP criteria also allows
the
established
option for controlling TCP connection traffic. (For a summary
of the extended ACL syntax options, refer to table 9-7 on page 9-53.)
Syntax: access-list < 100 - 199 > < deny | permit > < tcp | udp >
< SA > [ comparison - operator < tcp/udp - src-port >]
< DA > [ comparison - operator < tcp-dest-port >] [established]
< DA > [ comparison - operator < udp-dest-port >]
This source-port and destination-port TCP/UDP criteria is iden­
tical to the criteria described for TCP/UDP use in named, extended
ACLs, beginning on page 9-61.
Additional Options for ICMP Traffic. This option is useful where it is
necessary to permit some types of ICMP traffic and deny other types, instead
of simply permitting or denying all types of ICMP traffic. That is, an ACE
designed to permit or deny ICMP traffic can optionally include an ICMP type
and code value to permit or deny an individual type of ICMP packet while not
addressing other ICMP traffic types in the same ACE. As an optional alterna­
tive, the ACE can include the name of an ICMP packet type. (For a summary
of the extended ACL syntax options, refer to table 9-7 on page 9-53.)
Syntax: access-list < 100 - 199 > < deny | permit > icmp < SA > < DA >
[[ icmp-type [ icmp-code ]] | [ icmp-type-name ]]
The ICMP “type” and “code” criteria are identical to the criteria
described for ICMP in named, extended ACLs, beginning on page
9-63.
Additional Option for IGMP. This option is useful where it is necessary to
permit some types of IGMP traffic and deny other types, instead of simply
permitting or denying all types of IGMP traffic. That is, an ACE designed to
permit or deny IGMP traffic can optionally include an IGMP packet type to
permit or deny an individual type of IGMP packet while not addressing other
IGMP traffic types in the same ACE. (For a summary of the extended ACL
syntax options, refer to table 9-7 on page 9-53.)
9-71