HP ProCurve 2910al Access Security Manual page 349

Options for TCP and UDP Traffic in Extended ACLs. An ACE designed
to permit or deny TCP or UDP traffic can optionally include port number
criteria for either the source or destination, or both. Use of TCP criteria also
allows the established option for controlling TCP connection traffic. (For a
summary of the extended ACL syntax options, refer to table 9-7 on page 9-53.)
Syntax: < deny | permit > < tcp | udp >
< SA > [comparison-operator < tcp/udp-src-port >]
< DA >
[comparison-operator < tcp-dest-port >] [established]
[comparison-operator < udp-dest-port >]
In an extended ACL using either tcp or udp as the packet protocol
type, you can optionally use TCP or UDP source and/or desti­
nation port numbers or ranges of numbers to further define the
criteria for a match. For example:
#
deny tcp host 10.20.10.17 eq 23 host 10.20.10.155
established
#permit tcp host 10.10.10.100 host 10.20.10.17
eq telnet
#deny udp 10.30.10.1/24 host 10.20.10.17 range
161 162
[comparison-operator < tcp/udp-src-port >]
To specify a TCP or UDP source port number in an ACE, (1)
select a comparison operator from the following list and (2)
enter the port number or a well-known port name.
Comparison Operators:
eq < tcp/udp-port-nbr >
•
ACE entry, the TCP or UDP source port number in a packet
must be equal to < tcp/udp-port-nbr >.
gt < tcp/udp-port-nbr >
•
the ACE entry, the TCP or UDP source port number in a
packet must be greater than < tcp/udp-port-nbr >.
lt < tcp/udp-port-nbr >
•
ACE entry, the TCP or UDP source port number in a packet
must be less than < tcp/udp-port-nbr >.
neq < tcp/udp-port-nbr>
•
the ACE entry, the TCP or UDP source port number in a
packet must not be equal to < tcp/udp-port-nbr >.
range < start-port-nbr > < end-port-nbr >
•
ACE entry, the TCP or UDP source-port number in a packet
must be in the range <start-port-nbr >
< end-port-nbr >.
IPv4 Access Control Lists (ACLs)
Configuring Extended ACLs
— "Equal To"; to have a match with the
— "Greater Than"; to have a match with
"Less Than"; to have a match with the
—
"Not Equal"; to have a match with
—
For a match with the
—
9-61