HP PROCURVE 2910AL, Руководство по обеспечению безопасности доступа

Страница: 342 / 594

IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
Action Command(s) Page
Enter or Remove a ProCurve(config)# ip access-list extended < name-str | 100-199 > 9-81
Remark ProCurve(config-ext-nacl)# [ remark < remark-str > | no < 1 - 2147483647 > remark ] 9-83
For numbered, extended ACLs only, the following remark commands can be
substituted for the above:
ProCurve(config)# access-list < 100 - 199 > remark < remark-str >
ProCurve(config)# [no] access-list < 100 - 199 > remark
Delete an Extended ProCurve(config)# no ip access-list extended < name-str | 100-199 > 9-74
ACL
For numbered, extended ACLs only, the following command can also be used:
ProCurve(config)# no access-list < 100 - 199 >
Standard ACLs use only source IPv4 addresses for filtering criteria, extended
ACLs use multiple filtering criteria. This enables you to more closely define
your IPv4 packet-filtering. Extended ACLs enable filtering on the following:
■ Source and destination IPv4 addresses (required), in one of the
following options:
• specific host
• subnet or group of addresses
• any address
■ choice of any IPv4 protocol
■
optional packet-type criteria for IGMP, and ICMP traffic
■ optional source and/or destination TCP or UDP port, with a further
option for comparison operators and (for TCP) an option for estab­
lishing connections
■ filtering for TCP traffic based on whether the subject traffic is initi­
ating a connection (“established” option)
■ optional IP precedence and ToS criteria
The switch allows up to 512 ACLs, and determines the total from the number
of unique identifiers in the configuration. For example, configuring two ACLs
results in an ACL total of two, even if neither is assigned to an interface. If you
then assign a nonexistent ACL to an interface, the new ACL total is three,
because the switch now has three unique ACL names in its configuration. (For
more on ACL limits, refer to “Monitoring Shared Resources” on page 9-100.)
9-54