HP 3500yl Series Access Security Manual page 529

ip access-list extended LIST-20-IN
; CREATED ON JUNE 27
10 remark "THIS ACE APPLIES INBOUND ON VLAN 20"
10 permit tcp any host 10.10.20.98 eq http
20 permit tcp any host 10.10.20.21 eq http
30 deny tcp any 10.10.20.1/24 eq http
; VLAN 20 SOURCES TO VLAN 10 DESTINATIONS.
40 deny tcp host 10.10.20.17 host 10.10.10.100 eq telnet log
;
The " "
50 deny tcp host 10.10.20.23 host 10.10.10.100 eq telnet log
enables a
60 deny tcp host 10.10.20.40 host 10.10.10.100 eq telnet log
comment
70 permit ip 10.10.20.1/24 host 10.10.10.100
in the file.
80 remark "VLAN 30 POLICY."
80 deny ip 10.10.30.1/24 host 10.10.10.100
90 permit ip 10.10.30.1/24 10.10.10.1/24
exit
vlan 20 ip access-group "LIST-20-in" in
;
Note: You can use the " " character to denote a comment. The file
stored on your TFTP server retains comments, and they appear
when you use copy to download the ACL command file. (Comments
are not saved in the switch configuration.)
Figure 10-40. Example of a .txt File Designed for Creating an ACL
Deny all other IPv4 traffic from VLAN 20 to VLAN 10.
■
■ Deny all IPv4 traffic from VLAN 30 (10.10.30.0) to the server at
10.10.10.100 on VLAN 10 (without ACL logging), but allow any other
IPv4 traffic from VLAN 30 to VLAN 10.
Deny all other inbound IPv4 traffic to VLAN 20. (Hint: The Implicit
■
Deny can achieve this objective.)
You would create a .txt file with the content shown in figure 10-41.
1.
2. After you copy the above .txt file to a TFTP server the switch can access,
you would then execute the following command:
copy tftp command-file 10.10.10.1 LIST-20-IN.txt pc
IPv4 Access Control Lists (ACLs)
Creating or Editing ACLs Offline
10-109