HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 440 / 732

10-60
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Standard ACLs use only source IPv4 addresses for filtering criteria, extended
ACLs use multiple filtering criteria. This enables you to more closely define
your IPv4 packet-filtering. Extended ACLs enable filtering on the following:
■
Source and destination IPv4 addresses (required), in one of the
following options:
• specific host
• subnet or group of addresses
• any address
■ choice of any IPv4 protocol
■
optional packet-type criteria for IGMP, and ICMP traffic
■ optional source and/or destination TCP or UDP port, with a further
option for comparison operators and (for TCP) an option for estab-
lishing connections
■ filtering for TCP traffic based on either TCP control bits or whether
the subject traffic is initiating a connection (“established” option)
■ optional IP precedence and ToS criteria
The switch allows up to 2048 ACLs in any combination of IPv4 and IPv6 ACLs,
and determines the total from the number of unique identifiers in the config-
uration. For example, configuring two ACLs results in an ACL total of two,
even if neither is assigned to an interface. If you then assign a nonexistent ACL
to an interface, the new ACL total is three, because the switch now has three
unique ACL names in its configuration. (For more on ACL limits, refer to
“Monitoring Shared Resources” on page 10-129.)
Use Sequence Num-
ber To Delete an ACE HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-std-nacl)# no < 1-2147483647 >
10-90
Resequence the ACEs
in an ACL HP Switch(config)# ip access-list resequence < name-str | 100-199 >
< 1-2147483647 > < 1-2147483646 >
10-91
Enter or Remove a
Remark HP Switch(config)# ip access-list extended < name-str | 100-199 >
HP Switch(config-ext-nacl)# [ remark < remark-str > | no < 1 - 2147483647 > remark ]
For numbered, extended ACLs only, the following remark commands can be
substituted for the above:
HP Switch(config)# access-list < 100 - 199 > remark < remark-str >
HP Switch(config)# [no] access-list < 100 - 199 > remark
10-92
10-95
Delete an Extended
ACL HP Switch(config)# no ip access-list extended < name-str | 100-199 >
For numbered, extended ACLs only, the following command can also be used:
HP Switch(config)# no access-list < 100 - 199 >
10-85
Action Command(s) Page