How An Ace Uses A Mask To Screen Packets For Matches; What Is The Difference Between Network (Or Subnet) Masks And The Masks Used With Acls - HP ProCurve 2910al Access Security Manual

IPv4 Access Control Lists (ACLs)
Planning an ACL Application
9-28
Explicitly Permitting Any IPv4 Traffic: Entering a permit any or a
■
permit ip any any ACE in an ACL permits all IPv4 traffic not previously
permitted or denied by that ACL. Any ACEs listed after that point do
not have any effect.
Explicitly Denying Any IPv4 Traffic: Entering a deny any or a deny
■
ip any any ACE in an ACL denies all IPv4 traffic not previously per­
mitted or denied by that ACL. Any ACEs after that point have no effect.
■ Replacing One ACL with Another Using the Same Application:
For a specific interface, the most recent ACL assignment using a given
application replaces any previous ACL assignment using the same
application on the same interface.
Static Port ACLs: These are applied per-port, per port-list, or per
■
static trunk. Adding a port to a trunk applies the trunk's ACL config­
uration to the new member. If a port is configured with an ACL, the
ACL must be removed before the port is added to the trunk. Also,
removing a port from an ACL-configured trunk removes the ACL
configuration from that port.
How an ACE Uses a Mask To Screen Packets for
Matches
When the switch applies an ACL to IPv4 traffic, each ACE in the ACL uses an
IPv4 address and ACL mask to enforce a selection policy on the packets being
screened. That is, the mask determines the range of IPv4 addresses (SA only
or SA/DA) that constitute a match between the policy and a packet being
screened.
What Is the Difference Between Network (or Subnet)
Masks and the Masks Used with ACLs?
In common IPv4 addressing, a network (or subnet) mask defines which part
of the address to use for the network number and which part to use for the
hosts on the network. For example:
Address Mask
10.38.252.195 255.255.255.0 first three octets
10.38.252.195 255.255.248.0 first two octets and the left-
Network Address
most five bits of the third octet third octet and all bits in the
Host Address
The fourth octet.
The right most three bits of the
fourth octet.