HP ProCurve Series 3400cl Release Notes page 58

Enhancements
Release M.10.02 Enhancements
Terminology
ACE: See Access Control Entry, below.
Access Control Entry (ACE): An ACE is a policy consisting of a packet-handling action and criteria
to define the packets on which to apply the action. For RADIUS-based ACLs, the elements
composing the ACE include:
• permit or drop (action)
• in < ip-packet-type > from any (source)
• to < ip-address [/ mask ] | any > (destination)
[ port-# ] (optional TCP or UDP application port numbers used when the packet type is TCP
•
or UDP)
• [ cnt ] (optional counter that increments when there is a packet match)
ACL: See Access Control List, below.
Access Control List (ACL): A list (or set) consisting of one or more explicitly configured Access
Control Entries (ACEs) and terminating with an implicit "deny" default which drops any packets
that do not have a match with any explicit ACE in the named ACL.
ACL Mask: Follows a destination IP address listed in an ACE. Defines which bits in a packet's
corresponding IP addressing must exactly match the IP addressing in the ACE, and which bits
need not match (wildcards).
DA: The acronym for Destination IP Address. In an IP packet, this is the destination IP address
carried in the header, and identifies the destination intended by the packet's originator.
Deny: An ACE configured with this action causes the switch to drop a packet for which there is a
match within an applicable ACL.
Deny Any Any: An abbreviated form of deny in ip from any to any, which denies any inbound IP traffic
from any source to any destination.
Extended ACL: This type of Access Control List uses layer-3 IP criteria composed of source and
destination IP addresses and (optionally) TCP or UDP port criteria to determine whether there
is a match with an IP packet. On the 3400cl switches, the source IP address is always defined as
"any", and extended ACLs apply only to inbound bridged or routed traffic. For a RADIUS-based,
extended ACL assigned to a port, only the inbound traffic from the client whose authentication
caused the ACL assignment is filtered. Inbound traffic from any other sources is denied.
Implicit Deny: If the switch finds no matches between an inbound packet and the configured criteria
in an applicable ACL, then the switch denies (drops) the packet with an implicit "deny IP any/
any" operation. You can preempt the implicit "deny IP any/any" in a given ACL by configuring
permit in ip from any to any as the last explicit ACE in the ACL. Doing so permits any inbound IP
48