Configuration Notes - HP 3500yl Series Access Security Manual

Configuring and Using Dynamic (RADIUS-Assigned) Access Control Lists

Configuration Notes

Explicitly Permit IPv4 and IPv6 Traffic From an Authenticated
Client. This option for ending a RADIUS-assigned ACL permits all of the
client's inbound IPv4 and IPv6 traffic not previously permitted or denied.
Nas-filter-Rule += permit in ip from any to any
HP-Nas-Rules-IPv6 = 1
(Refer to table 7-7 on page 7-24 for information on the above attributes.)
Explicitly Permit Only the IPv4 Traffic From an Authenticated Client.
Any of the following three options for ending a RADIUS-assigned ACL explic-
itly permit all of the client's inbound IPv4 traffic not previously permitted or
denied. These options also deny any of the client's IPv6 traffic not previously
permitted or denied.
■
Nas-filter-Rule += permit in ip from any to any
(Using this attribute to permit IPv4 traffic from the client while denying
any IPv6 traffic from the client assumes that
exist elsewhere in the ACL. Refer to table 7-7 on page 7-24 for more on
)
HP-Nas-Rules-IPv6.
■
HP-Nas-Filter-Rule += permit in ip from any to any
■
Nas-filter-Rule += permit in ip from any to any
HP-Nas-Rules-IPv6 = 2
Explicitly Denying Inbound Traffic From an Authenticated Client.
Any of the following three options for ending a RADIUS-assigned ACL explic-
itly deny all of the client's inbound IPv4 and IPv6 traffic not previously
permitted or denied.
■
Nas-filter-Rule += deny in ip from any to any
■
HP-Nas-Filter-Rule += deny in ip from any to any
■
Nas-filter-Rule += deny in ip from any to any
HP-Nas-Rules-IPv6 = 2
Implicitly Denying Any IP Traffic. For any packet being filtered by a
RADIUS-assigned ACL, there will always be a match. That is, any packet that
does not have a match with an explicit permit or deny ACE in the list will
match with the implicit "deny any any" ACE automatically included at the end
of the ACL. That is, a RADIUS-assigned ACL includes an implicit deny in ip from
any to any ACE at the end of the ACL to deny any IPv4 and IPv6 traffic not
previously permitted or denied.
Configuring RADIUS Server Support for Switch Services
HP-Nas-Rules-IPv6 = 1
does not
7-35