HP 6400cl, Руководство по управлению

Страница: 361 / 664

Access Control Lists (ACLs) for the Series 5300xl Switches
ACL Operation
N o t e
The order in which an ACE occurs in an ACL is significant. For example, if an
ACL contains six ACEs, but the first ACE is a “permit IP any”, then the ACL
permits all IP traffic, and the remaining ACEs in the list do not apply, even if
they specify criteria that would make a match with any of the traffic permitted
by the first ACE.
For example, suppose you want to configure an ACL on the switch (with an
ID of “100”) to invoke these policies:
1. Permit all inbound traffic on VLAN 12 routed from IP address 11.11.11.42.
2. Deny only the inbound Telnet traffic routed from address 11.11.11.101.
3. Permit only inbound Telnet traffic routed from IP address 11.11.11.33.
4. Deny all other inbound routed traffic on VLAN 12.
The following ACL model, when assigned to inbound filtering on VLAN 12,
supports the above case:
4
2. Denies Telnet traffic routed from source address 11.11.11.101.
Packets matching this criterion are dropped and are not
compared to later criteria in the list. Packets not matching this
criterion are compared to the next entry in the list.
1. Permits IP traffic routed from source address 11.11.11.42.
Packets matching this criterion are permitted and will not be
compared to any later ACE in the list. Packets not matching this
criterion will be compared to the next entry in the list.
4. Permits Telnet traffic routed from source address 11.11.11.33.
Packets matching this criterion are permitted and are not
compared to any later criteria in the list. Packets not matching
this criterion are compared to the next entry in the list.
5. This entry does not appear in an actual ACL, but is implicit as
the last entry in every ACL. Any routed packets that do not match
any of the criteria in the ACL’s preceding entries will be denied
(dropped), and will not cross VLAN 12.
1
2
3. Permits any IP traffic routed from source address 11.11.11.101.
Any packets matching this criterion will be permitted and will
not be compared to any later criteria in the list. Because this
entry comes after the entry blocking Telnet traffic from this
same address, there will not be any Telnet packets to compare
with this entry; they have already been dropped as a result of
matching the preceding entry.
3
5
Figure 9-4. Example of How an ACL Filters Packets
9-15