Filter
Top Products
Using Access Control Lists (ACLs)
NOTE: Do not place other commands in the file. The HP device reads only the ACL information in the file and
ignores other commands, including ip access-group commands. To assign ACLs to interfaces, use the CLI.
Applying an ACL to a Subset of Ports on a Virtual Interface
You can apply an ACL to a virtual routing interface. The virtual interface is used for routing between VLANs and
contains all the ports within the VLAN. If the ACL is for the inbound traffic direction, you also can specify a subset
of ports within the VLAN containing a specified virtual interface when assigning an ACL to that virtual interface.
Use this feature when you do not want the ACLs to apply to all the ports in the virtual interface’s VLAN or when
you want to streamline ACL performance for the VLAN.
NOTE: This feature applies only to a virtual interface’s inbound direction. You cannot use this feature to specify
a subset of ports for a virtual interface’s outbound direction.
To apply an ACL to a subset of ports within a virtual interface, enter commands such as the following:
HP9300(config)# vlan 10 name IP-subnet-vlan
HP9300(config-vlan-10)# untag ethernet 1/1 to 2/12
HP9300(config-vlan-10)# router-interface ve 1
HP9300(config-vlan-10)# exit
HP9300(config)# access-list 1 deny host 209.157.22.26 log
HP9300(config)# access-list 1 deny 209.157.29.12 log
HP9300(config)# access-list 1 deny host IPHost1 log
HP9300(config)# access-list 1 permit any
HP9300(config)# interface ve 1
HP9300(config-vif-1)# ip access-group 1 in ethernet 1/1 ethernet 1/3 ethernet 2/1 to
2/4
The commands in this example configure port-based VLAN 10, add ports 1/1 – 2/12 to the VLAN, and add virtual
routing interface 1 to the VLAN. The commands following the VLAN configuration commands configure ACL 1.
Finally, the last two commands apply ACL 1 to a subset of the ports associated with virtual interface 1.
Syntax: [no] ip access-group <num> in ethernet <portnum> [<portnum>...] to <portnum>
Enabling Strict TCP or UDP Mode
By default, when you use ACLs to filter TCP or UDP traffic, the HP device does not compare all TCP or UDP
packets against the ACLs.
• TCP – By default, the device compares TCP control packets against the ACLs, but not data packets. Control
packets include packet types such as SYN (Synchronization) packets, FIN (Finish) packets, and RST (Reset)
packets
• UDP – By default, the device compares the source and destination information against entries in the session
table. The session table contains forwarding entries based on Layer 3 and Layer 4 information.
• If the session table contains a matching entry, the device forwards the packet, assuming that the first
packet the device received that contains the same address information was permitted by the ACLs.
• If the session table does not contain a matching entry, the device sends the packet to the CPU, where
the software compares the packet against the ACLs. If the ACLs permit the packet (explicitly by a permit
ACL entry or implicitly by the absence of a deny ACL entry), the CPU creates a session table entry for
the packet’s forwarding information and forwards the packet.
For tighter access or forwarding control, you can enable the device to perform strict TCP or UDP ACL processing.
Strict ACL processing causes every TCP or UDP packet to go to the CPU for examination. The following sections
describe the strict modes in more detail.
3 - 21