HP 6120XG HP ProCurve Series 6120 Blade Switches Access Security Guide - Page 355
Example of an ACL with an Access Control Entry ACE that Allows Only One Source IP Address
View all HP 6120XG manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 355 highlights
IPv4 Access Control Lists (ACLs) Traffic Management and Improved Network Performance . This ACL (a standard ACL named "Fileserver") includes an ACE (Access Control Entry) that permits matches only with the packets received from IP address 10.28.252.117 (the SA). Packets from any other source do not match and are denied. ip access-list standard Fileserver Source IP Address (SA) permit 10.28.252.117 0.0.0.0 ACE exit Mask (All zeros mean that a match occurs only when an IP packet's source address is identical to the source address configured in the ACE. Inbound Packet "A" On Port 20 - Destination Address: 10.35.248.184 - Source Address: 10.28.252.117 The port permits packet "A" because its source IP address matches the source address in the ACE. Inbound Packet "B" On Port 20 - Destination Address: 10.35.248.184 - Source Address: 10.28.252.120 The port denies (drops) packet "B" because its source IP address does not match the source address in the ACE. Figure 9-7. Example of an ACL with an Access Control Entry (ACE) that Allows Only One Source IP Address Examples Allowing Multiple IP Addresses. Table 9-4 provides examples of how to apply masks to meet various filtering requirements. Table 9-4. Example of Using an IP Address and Mask in an Access Control Entry IP Address in the ACE Mask Policy for a Match Between a Allowed IP Addresses Packet and the ACE A: 10.38.252.195 0.0.0.255 Exact match in first three octets only. 10.38.252.< 0-255 > (See row A in table 9-5, below.) B: 10.38.252.195 C: 10.38.252.195 D: 10.38.252.195 0.0.7.255 Exact match in the first two 10.38.< 248-255 >.< 0-255 > octets and the leftmost five bits (In the third octet, only the rightmost three bits are (248) of the third octet. wildcard bits. The leftmost five bits must be a match, and in the ACE, these bits are all set to 1. See row B in table 9-5, below.) 0.0.0.0 Exact match in all octets. 10.38.252.195 (There are no wildcard bits in any of the octets. See row C in table 9-5, below.) 0.15.255.255 Exact match in the first octet 10.< 32-47 >.< 0-255 >. and the leftmost four bits of the (In the second octet, the rightmost four bits are second octet. wildcard bits. See row D in table 9-5, below.) 9-31