Implicit Deny Rule - HP procurve 8100fl series Management And Configuration Manual

N o t e
ProCurve(config)#access-list 101 permit ip 100.20.30.40/24 any
ProCurve(config)#access-list 101 permit ip 124.123.220.10/24 any dscp
default
ProCurve(config)#access-list 102 deny ip 172.124.200.0/24 any
ProCurve(config)#access-list 102 deny ip 172.124.200.0/24 any
ProCurve(config)#access-list 102 deny any
Remember that the first rule that applies to a packet is the only rule that affects
the packet. The packet is permitted or denied according to the first rule it
satisfies; none of the remaining ACL rules have any effect on the packet.

Implicit Deny Rule

At the end of each ACL, the switch automatically appends the implicit deny
rule. For a packet or route that doesn't match any of the user-specified rules,
the implicit deny rule acts as a catch-all rule that denies all packet or routes
– all packets match this rule.
The implicit deny rule exists for security reasons. If an ACL is misconfigured,
and a packet that should be allowed to go through is blocked by the implicit
deny rule, the worst that happens is an inconvenience. However, a security
breach results if a packet that should not be allowed through is sent through.
As a result, the implicit deny rule serves as a fail-safe against the accidental
misconfiguration of ACLs.
To illustrate how the implicit deny rule works, consider the following ACL:
If a packet comes in and doesn't match either of the first two rules, the packet
is dropped, because the third rule (the implicit deny rule) matches all packets.
Although the implicit deny rule may seem obvious in the previous example,
this is not always the case.
For example, consider the following ACL rule:
If a packet comes in from a subnet other than 172.124.200.0/24, one might expect
the packet to go through, because it doesn't match the first rule, however, this
is not the case. With the implicit deny rule attached, the rule looks like this:
A packet coming from a subnet other than 172.124.200.0 would not match the
first rule, but would match the implicit deny rule. As a result, no packets would
be allowed through.
Access Control Lists (ACLs)
Layer 3 Access Control List (ACLs)
15-7