HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 426 / 732

10-46
IPv4 Access Control Lists (ACLs)
Configuring and Assigning an IPv4 ACL
For example, suppose that you have applied the ACL shown in figure 10-13 to
inbound IPv4 traffic on VLAN 1 (the default VLAN):
Figure 10-13. Example of a Standard ACL that Permits All IPv4 Traffic Not Implicitly Denied
Table 10-5. Effect of the Above ACL on Inbound IPv4 Traffic in the Assigned VLAN
Line # Action
n/a Shows type ( extended ) and ID (Sample-List-2).
10 A packet from SA 10.28.235.10 will be denied (dropped). This ACE filters out all packets received from
10.28.235.10. As a result, IPv4 traffic from that device will not be allowed and packets from that device will not
be compared against any later entries in the list.
20 A packet from SA 10.28.245.89 will be denied (dropped). This ACE filters out all packets received from
10.28.245.89. As the result, IPv4 traffic from that device will not be allowed and packets from that device will
not be compared against any later entries in the list.
30 A TCP packet from SA 10.28.18.100 with a DA of 10.28.237.1 will be permitted (forwarded). Since no earlier ACEs
in the list have filtered TCP packets from 10.28.18.100 and destined for 10.28.237.1, the switch will use this ACE
to evaluate such packets. Any packets that meet this criteria will be forwarded. (Any packets that do not meet
this TCP source-destination criteria are not affected by this ACE.)
40 A TCP packet from source address 10.28.18.100 to any destination address will be denied (dropped). Since, in
this example, the intent is to block TCP traffic from 10.28.18.100 to any destination except the destination stated
in the ACE at line 30, this ACE must follow the ACE at line 30. (If their relative positions were exchanged, all TCP
traffic from 10.28.18.100 would be dropped, including the traffic for the 10.28.18.1 destination.)
50 Any packet from any IPv4 SA to any IPv4 DA will be permitted (forwarded). The only traffic to reach this ACE
will be IPv4 packets not specifically permitted or denied by the earlier ACEs.
n/a The Implicit Deny is a function the switch automatically adds as the last action in all ACLs. It denies (drops) any
IPv4 traffic from any source to any destination that has not found a match with earlier entries in the ACL. In this
example, the ACE at line 50 permits (forwards) any IPv4 traffic not already permitted or denied by the earlier
entries in the list, so there is no traffic remaining for action by the Implicit Deny function.
exit Marks the end of the ACL.
ip access-list extended "Sample-List-2"
10 deny ip 10.28.235.10 0.0.0.0 0.0.0.0 255.255.255.255
20 deny ip 10.28.245.89 0.0.0.0 0.0.0.0 255.255.255.255
30 permit tcp 10.28.18.100 0.0.0.0 10.28.237.1 0.0.0.0
40 deny tcp 10.28.18.100 0.0.0.0 0.0.0.0 255.255.255.255
50 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
(Implicit Deny)
exit
After the last explicit ACE there is always an Implicit Deny. However, in this case it will not be used
because the last,
permit ip
ACL allows all IPv4 packets that earlier ACEs have not already permitted or
Source Address
DestinationAddress
Mask
Mask