HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 407 / 732

10-27
IPv4 Access Control Lists (ACLs)
IPv4 Static ACL Operation
no further comparisons of the packet are made with the remaining ACEs in
the list. This means that when an ACE whose criteria matches a packet is
found, the action configured for that ACE is invoked, and any remaining ACEs
in the ACL are ignored.
Because of this sequential processing, successfully
implementing an ACL depends in part on configuring ACEs in the correct
order for the overall policy you want the ACL to enforce
.
Figure 10-6. The Packet-Filtering Process in an ACL with N Entries (ACEs)
Is there a
match?
Perform action
(permit or deny).
No
Test a packet against
criteria in first ACE.
Yes
No
Yes
Deny the packet
(invoke an Implicit
Deny).
End
Perform action
(permit or deny).
End
End
Test the packet against
criteria in second ACE.
Is there a
match?
Test packet against
criteria in N th ACE.
Is there a
match?
No
Yes
End
Perform action
(permit or deny).
1. If a match is not found with
the first ACE in an ACL, the
switch proceeds to the next
ACE and so on.
2. If a match with an explicit
ACE is subsequently found,
the packet is either permit-
ted (forwarded) or denied
(dropped), depending on
the action specified in the
matching ACE. In this case
the switch ignores all sub-
sequent ACEs in the ACL.
3. If a match is not found with
any explicit ACE in the ACL,
the switch invokes the
Implicit Deny at the end of
every ACL, and drops the
packet.
Note: If the list includes an
ACE configured with Permit
Any forwarding, no packets
can reach the Implicit Deny
at the end of the list. Also,
placing an ACE with Permit
Any forwarding at any point
in an ACL defeats the
purpose of any subsequent
ACEs in the list.