Acl Configuration Factors - HP E3800-24G-PoE+-2SFP+ Access Security Manual

HP Switch(config)# show running
Running configuration:
; J9573A Configuration Editor; Created on release #KA.15.03
; Ver #01:00:01
Protocol Types
hostname "HP Switch"
ip access-list extended "Sample-List-1"
10 permit ip 10.38.130.55 0.0.0.0 10.38.130.240 0.0.0.0
20 permit tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 23
30 remark "ALLOWS HTTP FROM SINGLE HOST."
30 permit tcp 10.38.131.14 0.0.0.0 eq 80 0.0.0.0 255.255.255.255 eq 3871
40 remark "DENIES HTTP FROM ANY TO ANY."
40 deny tcp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 eq 80 log
50 deny udp 10.42.120.19 0.0.0.0 eq 69 10.38.140.44 0.0.0.0 range 3680 3690 log
60 deny udp 0.0.0.0 255.255.255.255 10.38.99.121 0.0.0.0 log
exit
End-of-List
Marker
ACE Action
(permit or deny)
Figure 10-12. Example of a Displayed Extended ACL Configuration
For example, figure 10-12 shows how to interpret the entries in an extended
ACL.
ACL List Heading with
List Type and ID String
(Name or Number)
Source Addresses and
Masks.
Upper entry denies certain
UDP packets from a single
host. Lower entry denies all
UDP packets from all hosts.

ACL Configuration Factors

The Sequence of Entries in an ACL Is Significant
When the switch uses an ACL to determine whether to permit or deny a packet,
it compares the packet to the criteria specified in the individual Access
Control Entries (ACEs) in the ACL, beginning with the first ACE in the list and
proceeding sequentially until a match is found. When a match is found, the
switch applies the indicated action (permit or deny) to the packet. This is
significant because, once a match is found for a packet, subsequent ACEs in
the same ACL will not be applied to that packet, regardless of whether they
match the packet.
Configuring and Assigning an IPv4 ACL
Remark for ACE at Line 40
Optional Source UDP
Destination
or TCP Operator and
Address and Mask
Port Number
In this case, the ACL
specifies UDP port 69
packets coming from
the source address.
IPv4 Access Control Lists (ACLs)
Indicates all possible
destination IPv4
addresses.
Denies TCP
Port 80 IPv4
traffic to any
destination
from any
source.
Optional Destination
UDP or TCP Operator
and Range of Port
Numbers
In this case, the ACL
specifies UDP port
numbers 3680-3690.
10-45