HP PROCURVE 2910AL, Руководство по обеспечению безопасности доступа

Страница: 324 / 594

IPv4 Access Control Lists (ACLs)
Configuring and Assigning an IPv4 ACL
3. One or more deny/permit list entries (ACEs): One entry per line.
Element Notes
Type Standard or Extended
Identifier • Alphanumeric; Up to 64 Characters, Including
Spaces
• Numeric: 1 - 99 (Standard) or 100 - 199 (Extended)
Remark Allows up to 100 alphanumeric characters, including
blank spaces. (If any spaces are used, the remark
must be enclosed in a pair of single or double
quotes.) A remark is associated with a particular ACE
and will have the same sequence number as the ACE.
(One remark is allowed per ACE.) Refer to “Attaching
a Remark to an ACE” on page 9-81.
Maximum ACEs Per per Switch The upper limit on ACEs supported by the switch
depends on the concurrent resource usage by
configured ACL, QoS, IDM, Mirroring, and other
features. Refer to “Monitoring Shared Resources”
on page 9-100.
4. Implicit Deny: Where an ACL is in use, it denies any packets that do not
have a match with the ACEs explicitly configured in the list. The Implicit
Deny does not appear in ACL configuration listings, but always functions
when the switch uses an ACL to filter packets. (You cannot delete the
Implicit Deny, but you can supersede it with a
permit any or permit ip any
any statement.)
Standard ACL Structure
Individual ACEs in a standard ACL include only a permit/deny statement, the
source addressing, and an optional
log command (available with “deny”
statements).
ip access-list standard < identifier >"
[ [ seq-# ] remark < remark-str >]
Note: The optional log
< permit | deny > < SA > [log]
function is available only
.
for explicit “deny” ACEs.
.
.
< Implicit Deny >
exit
Figure 9-6. Example of the General Structure for a Standard ACL
9-36