How Multiple Acl Rules Are Evaluated - HP procurve 8100fl series Management And Configuration Manual

Access Control Lists (ACLs)
Layer 3 Access Control List (ACLs)
ProCurve(config)#access-list 101 deny tcp 100.20.20.0/24 any
ProCurve(config)#access-list 101 permit tcp any any
ProCurve(config)#access-list 101 permit tcp any any
ProCurve(config)#access-list 101 deny tcp 100.20.20.0/24 any
15-6
Notice in the previous example that both the source address and the
destination address are skipped over using the any parameter. The keyword
any is needed only to skip a field in order to explicitly specify another field
whose position is further along in the ACL.

How Multiple ACL Rules are Evaluated

The sequence of the rules within an ACL consisting of multiple rules is
important. When an ACL application checks a packet or route against an ACL,
it applies rules in the order in which they reside within the ACL – from first to
last. The 8100fl switch also applies multiple ACLs in the order in which they
are configured (the order in which they appear in the running-config). If a
packet or route matches a rule, it is forwarded or dropped based on the permit
or deny keyword in the rule. If there is no match, the packet or route is passed
on to the next rule in the ACL.
Consequently, rules that are more specific (contain more match criteria)
should be listed ahead of rules that are less specific. For example, the
following ACL permits all TCP traffic except any TCP traffic from subnet
100.20.20.0/24:
In the previous example, the ACL 101 includes two rules:
Deny TCP packets from subnet 100.20.20.0
1.
2. Permit TCP packets
A TCP packet coming from subnet 10.2.0.0/16 matches the first ACL rule, which
results in the packet being dropped. However, a TCP packet coming from any
other subnet does not match the first ACL rule. Instead, it matches the second
ACL rule, which allows the TCP packet through.
Consider the case where the ACL rules in the previous example are reversed:
All TCP packets are allowed through, including packets from subnet
100.20.20.0. Because TCP traffic coming from 100.20.20.0 matches the first rule,
"all TCP packets are allowed through." The second rule is not applied because
the first rule that matches determines the action taken on the packet.