HP 3500yl Series Access Security Manual page 447

no further comparisons of the packet are made with the remaining ACEs in
the list. This means that when an ACE whose criteria matches a packet is
found, the action configured for that ACE is invoked, and any remaining ACEs
in the ACL are ignored. Because of this sequential processing, successfully
implementing an ACL depends in part on configuring ACEs in the correct
order for the overall policy you want the ACL to enforce.
Test a packet against
criteria in first ACE.
Is there a
match?
No
Test the packet against
criteria in second ACE.
Is there a
match?
No
Test packet against
criteria in Nth ACE.
Is there a
match?
No
Deny the packet
(invoke an Implicit
Deny).
Figure 10-6. The Packet-Filtering Process in an ACL with N Entries (ACEs)
Yes
Perform action
(permit or deny).
Yes
Perform action
(permit or deny).
Yes
Perform action
(permit or deny).
End
IPv4 Access Control Lists (ACLs)
IPv4 Static ACL Operation
1. If a match is not found with
the first ACE in an ACL, the
switch proceeds to the next
ACE and so on.
2. If a match with an explicit
End
ACE is subsequently found,
the packet is either permit-
ted (forwarded) or denied
(dropped), depending on
the action specified in the
matching ACE. In this case
the switch ignores all sub-
sequent ACEs in the ACL.
3. If a match is not found with
any explicit ACE in the ACL,
End
the switch invokes the
Implicit Deny at the end of
every ACL, and drops the
packet.
Note: If the list includes an
ACE configured with Permit
Any forwarding, no packets
can reach the Implicit Deny
at the end of the list. Also,
placing an ACE with Permit
Any forwarding at any point
in an ACL defeats the
purpose of any subsequent
ACEs in the list.
End
10-27