Applying Acls; Applying Acls To Interfaces - HP procurve 8100fl series Management And Configuration Manual

Access Control Lists (ACLs)

Applying ACLs

15-10

Applying ACLs

Until it is applied, an ACL itself is simply a set of one or more rules made up
of match criteria and an indicator that specifies whether to permit or deny
packets that meet the rules. For an ACL to actually do something on the switch,
it must be applied to an interface or to some application, which permits or
denies traffic to or from the switch.

Applying ACLs to Interfaces

An ACL can be applied to an interface to make decisions about either inbound
or outbound traffic. Inbound traffic is traffic coming into the switch. Outbound
traffic is traffic going out of the switch. For each interface, only one ACL can
be applied for the same protocol in the same direction. For example, you
cannot apply two or more IP ACLs to the same interface in the inbound
direction. You can apply two ACLs to the same interface if one is for inbound
traffic and one is for outbound traffic. However, this restriction does not
prevent you from specifying many rules in an ACL. Just put all of these rules
into one ACL and apply it to the interface.
When a packet enters the switch through an interface where an inbound ACL
is applied, the switch compares the packet to the rules specified by that ACL.
If it is permitted, the packet is allowed into the switch. If not, the packet is
dropped. When an outbound ACL is applied, the outbound packet is compared
to the rules specified in this outbound ACL. Consequently, it is possible for a
packet to go through two separate checks, once at the inbound interface and
once more at the outbound interface.
To apply an ACL to an interface:
1. Within configuration mode, set your context to the interface where the
criteria in the access list should be tested against inbound or outbound
traffic.
2. Use the ip access-group command to apply an ACL to that interface.
The following example shows how to apply an ACL called 101 to all
inbound packets on the gigabit ethernet slot 4 port 1 interface:
ProCurve(config)#interface gigabitethernet 4/1
ProCurve(config-if)#ip access-group 101 in