Filter
Top Products
Using Access Control Lists (ACLs)
• Specify the default next-hop IP address if there is no explicit next-hop selection for the packet.
• Send the packet to the null interface (null0).
HP’s PBR routing is based on standard and extended ACLs and route-maps. The ACLs classify the traffic. Route
maps that match on the ACLs set routing attributes for the traffic. HP's implementation of PBR uses high
performance switching algorithms including route caches and route tables.
Configuring PBR
To configure PBR:
• Configure ACLs that contain the source IP addresses for the IP traffic to which you want to apply PBR.
• Configure a route map that matches on the ACLs and sets route information.
• Apply the route map globally or to individual interfaces.
NOTE: All the procedures in the following sections are for the CLI.
Configure the ACLs
PBR uses route maps to change the routing attributes in IP traffic. This section shows an example of how to
configure a standard ACL to identify the source sub-net for IP traffic.
To configure a standard ACL to identify a source sub-net, enter a command such as the following:
HP9300(config)# access-list 1 permit 209.157.23.0 0.0.0.255
The command in this example configures a standard ACL that permits traffic from sub-net 209.157.23.0/24. After
you configure a route map that matches based on this ACL, the software uses the route map to set route attributes
for the traffic, thus enforcing PBR.
NOTE: Do not use an access group to apply the ACL to an interface. Instead, use a route map to apply the ACL
globally or to individual interfaces for PBR, as shown in the following sections.
Syntax: [no] access-list <num> deny | permit <source-ip> | <hostname> <wildcard> [log]
or
Syntax: [no] access-list <num> deny | permit <source-ip>/<mask-bits> | <hostname> [log]
Syntax: [no] access-list <num> deny | permit host <source-ip> | <hostname> [log]
Syntax: [no] access-list <num> deny | permit any [log]
The <num> parameter is the access list number and can be from 1 – 99.
The deny | permit parameter indicates whether packets that match a policy in the access list are denied
(dropped) or permitted (forwarded).
NOTE: If you are configuring the ACL for use in a route map, always specify permit. Otherwise, the routing
switch drops the traffic instead of further processing the traffic using the route map.
The <source-ip> parameter specifies the source IP address. Alternatively, you can specify the host name.
NOTE: To specify the host name instead of the IP address, the host name must be configured using the HP
device’s DNS resolver. To configure the DNS resolver name, use the ip dns server-address… command at the
global CONFIG level of the CLI.
The <wildcard> parameter specifies the mask value to compare against the host address specified by the
<source-ip> parameter. The <wildcard> is a four-part value in dotted-decimal notation (IP address format)
consisting of ones and zeros. Zeros in the mask mean the packet’s source address must match the <source-ip>.
Ones mean any value matches. For example, the <source-ip> and <wildcard> values 209.157.22.26 0.0.0.255
mean that all hosts in the Class C sub-net 209.157.22.x match the policy.
3 - 25