HP 3500yl Series Access Security Manual page 441

An inbound, switched packet entering on port A10, with a destination on port
A12, will be screened by the static port ACL and the VACL, regardless of a
match with any permit or deny action. A match with a deny action (including
an implicit deny) in either ACL will cause the switch to drop the packet. (If
the packet has a match with explicit deny ACEs in multiple ACLs and the log
option is included in these ACEs, then a separate log event will occur for each
match.) The switched packet will not be screened by the RACL.
However, suppose that VLAN 2 in figure 10-4 (page 10-21) is configured with
the following:
A VACL permitting traffic having a destination on the 10.28.10.0
■
subnet
An RACL that denies inbound traffic having a destination on the
■
10.28.10.0 subnet
In this case, no IPv4 traffic received on the switch from clients on the
10.28.20.0 subnet will reach the 10.28.10.0 subnet, even though the VACL
allows such traffic. This is because the deny in the RACL causes the switch to
drop the traffic regardless of whether any other VACLs permit the traffic.
Subnet Mask: 255.255.255.0.
• RACL on VLAN2 denies IPv4
traffic having a destination on
the 10.28.10.0 subnet.
• VACL on VLAN2 permits IPv4
traffic having a destination on
the 10.28.10.0 subnet.
Because the RACL on VLAN 2
denies traffic entering the
switch for the 10,28.10.0
subnet destination, no IPv4
traffic received inbound from
clients on the 10.28.20.0 subnet
will reach the 10.28.10.0
subnet, even though the VACL
permits this traffic.
Figure 10-4. Example of Order of Application for Multiple ACLs on an Interface
Exception for Connection-Rate Filtering. Connection-rate filtering can
be configured along with one or more other ACL applications on the same
interface. In this case, a connection-rate match for a filter action is carried out
according to the configured policy, regardless of whether any other ACLs on
the interface have a match for a deny action. Also, if a connection-rate filter
permits (ignore action) a packet, it can still be denied by another ACL on the
interface.
Switch with IPv4 Routing
A
10.28.10.5
VLAN 2 with a VACL and
an RACL
B
10.28.20.1
10.28.20.88
VLAN 3
(Multiple Subnets)
D
10.28.40.1
10.28.40.22
IPv4 Access Control Lists (ACLs)
Overview
VLAN 1
10.28.10.1
(One Subnet)
10.28.30.1
C
E
10-21