Standard ACLs use only source IPv4 addresses for filtering criteria, extended ACLs use multiple filtering criteria. This enables you to more closely define your IPv4 packet-filtering.
Extended ACLs enable filtering on source and destination IPv4 addresses (required), in one of the following options:
-
Source and destination IPv4 addresses for filtering criteria, extended ACLs use multiple filtering criteria. This enables you to more closely define your IPv4 packet filtering. Extended ACLs enable filtering on the following:
-
specific host
-
subnet or group of addresses
-
any address
-
-
choice of any IPv4 protocol
-
optional packet-type criteria for IGMP and ICMP traffic
-
optional source and/or destination TCP or UDP port, with a further option for comparison operators and (for TCP) an option for establishing connections
-
filtering for TCP traffic based on either TCPcontrol bits or whether the subject traffic is initiating a connection ("established" option)
-
optional IP precedence and ToS criteria
HP Switches allow up to 512 ACLs, and determines the total from the number of unique identifiers in the configuration. For example, configuring two ACLs results in an ACL total of two, even if neither is assigned to an interface. If you then assign a nonexistent ACL to an interface, the new ACL total is three, because the switch now has three unique ACL names in its configuration.
For a match to occur with an ACE in an extended ACL, a packet must have the source and destination address criteria specified by the ACE, as well as any IPv4 protocol-specific criteria included in the command.
Use the following general steps to create or add to a named, extended ACL:
The following command is a prerequisite to entering or editing ACEs in a named, extended ACL.
Syntax:
Places the CLI in the "Named ACL" (
nacl) context specified by the<name-str>alphanumeric identifier. This enables entry of individual ACEs in the specified ACL. If the ACL does not already exist, this command creates it.Specifies an alphanumeric identifier for the ACL. Consists of an alphanumeric string of up to 64 case-sensitive characters. Including spaces in the string requires that you enclose the string in single or double quotes. For example:
accounting ACL. You can also use this command to access an existing, numbered ACL. See Using the CLI to edit ACLs.
Configuring ACEs is done after using the ip access-list standard <name-str> command described.
See the section “Standard ACL structure” for filtering criteria, extended ACLs use multiple filtering criteria. This enables you to more closely define your IPv4 packet-filtering.
Syntax: (nacl context)
Appends an ACE to the end of the list of ACEs in the current ACL. In the default configuration, ACEs are automatically assigned consecutive sequence numbers in increments of 10 and can be renumbered using
resequence, see Resequencing the ACEs in an ACL).
NOTE: To insert a new ACE between two existing ACEs in an extended, named ACL, precede
denyorpermitwith an appropriate sequence number along with the ACE keywords and variables you want. See Inserting an ACE in an existing ACL.For a match to occur, a packet must have the source and destination addressing criteria specified in the ACE, as well as:
the protocol-specific criteria configured in the ACE, including any included, optional elements (described later in this section)
any (optional) precedence and/or ToS settings configured in the ACE
![[NOTE: ]](images/note.gif)
Used after
denyorpermitto specify the packet protocol type required for a match. An extended ACL must include one of the following:
ip– any IPv4 packet.
ip-protocol– any one of the following IPv4 protocol names:
ip-in-ipospfudp*ipv6-in-ippimicmp*grevrrpigmp*espsctpahtcp*
ip-protocol-nbr– the protocol number of an IPv4 packet type, such as "8" for Exterior Gateway Protocol or 121 for Simple Message Protocol. (For a listing of IPv4 protocol numbers and their corresponding protocol names, see theIANA "Protocol Number Assignment Services" at www.iana.com. (Range: 0–255)*For TCP, UDP, ICMP, and IGMP, additional criteria can be specified, as described on Including options for TCP and UDP traffic in extended ACLs.
This is the first instance of IPv4 addressing in an extended ACE. It follows the protocol specifier and defines the source address (SA) a packet must carry for a match with the ACE.
Specifies only packets having a single address as the SA. Use this criterion when you want to match only the IPv4 packets from a single SA.
Specifies packets received from an SA, where the SA is either a subnet or a group of addresses. The mask can be in either dotted-decimal format or CIDR format (number of significant bits).
The mask is applied to the SA in the ACL to define which bits in a packet's SA must exactly match the SA configured in the ACL and which bits need not match.
Example:
10.10.10.1/24 and 10.10.10.1 0.0.0.255 both define any address in the range of 10.10.10.(1 - 255).
Note: Specifying a group of contiguous addresses may require more than one ACE.
This is the second instance of IPv4 addressing in an extended ACE. It follows the first (SA) instance, described earlier, and defines the destination address (DA) that a packet must carry in order to have a match with the ACE.
Specifies only packets having
DAas the destination address. Use this criterion when you want to match only the IPv4 packets for a single DA.Specifies packets intended for a destination address, where the address is either a subnet or a group of addresses. The mask format can be in either dotted-decimal format or CIDR format (number of significant bits).
The mask is applied to the DA in the ACL to define which bits in a packet's DA must exactly match the DA configured in the ACL and which bits need not match.
This option can be used after the DA to cause the ACE to match packets with the specified IP precedence value. Values can be entered as the following IP precedence numbers or alphanumeric names:
NOTE: The precedence criteria described in this section are applied in addition to any other selection criteria configured in the same ACE.
This option can be used after the DA to cause the ACE to match packets with the specified Type-of-Service (ToS) setting. ToS values can be entered as the following numeric settings or, in the case of 0, 2, 4, and 8, as alphanumeric names:
NOTE: The ToS criteria in this section are applied in addition to any other criteria configured in the same ACE.
An ACE designed to permit or deny TCP or UDP traffic can optionally include port number criteria for either the source or destination, or both. Use of TCP criteria also allows the established option for controlling TCP connection traffic.
Syntax:
In an extended ACL using either
tcporudpas the packet protocol type, you can optionally use TCP or UDP source and/or destination port numbers or ranges of numbers to further define the criteria for a match. For example:#deny tcp host 10.20.10.17 eq 23 host 10.20.10.155 established#permit tcp host 10.10.10.100 host 10.20.10.17 eq telnet#deny udp 10.30.10.1/24 host 10.20.10.17 range 161 162To specify a TCP or UDP source port number in an ACE:
(1) Select a comparison operator from the following list
(2) Enter the port number or a well-known port name.
Comparison operators
"Equal To"; to have a match with the ACE entry, the TCP or UDP source port number in a packet must be equal to
<.tcp/udp-port-nbr>"Greater Than"; to have a match with the ACE entry, the TCP or UDP source port number in a packet must be greater than
<.tcp/udp-port-nbr>"Less Than"; to have a match with the ACE entry, the TCP or UDP source port number in a packet must be less than
<.tcp/udp-port-nbr>"Not Equal"; to have a match with the ACE entry, the TCP or UDP source port number in a packet must not be equal to
<.tcp/udp-port-nbr>
range <start-port-nbr> <end-port-nbr>For a match with the ACE entry, the TCP or UDP source-port number in a packet must be in the range
<start-port-nbr><.end-port-nbr>Port number or well-known port name:
Use the TCP or UDP port number required by your application.
The switch also accepts these well-known TCP or UDP port names as an alternative to their port numbers:
TCP – bgp, dns, ftp, http, imap4, ldap, nntp, pop2, pop3, smtp, ssl, telnet
UDP – bootpc, bootps, dns, ntp, radius, radius-old, rip, snmp, snmp-trap, tftp
To list the above names, press the [Shift] [?] key combination after entering an operator. For a comprehensive listing of port numbers, visit www.iana.org/assignments/port-numbers.
This option, if used, is entered immediately after the
<DA>entry.To specify a TCP or UDP port number;
Comparison operators and well-known port names:
These are the same as are used with the TCP/UDP source-port options, and are listed earlier in this command description.
This option applies only where TCP is the configured protocol type. It blocks the synchronizing packet associated with establishing a TCP connection in one direction on a VLAN while allowing all other IPv4 traffic for the same type of connection in the opposite direction. For example, a Telnet connect requires TCP traffic to move both ways between a host and the target device. Simply applying a
denyto inbound Telnet traffic on a VLAN would prevent Telnet sessions in either direction because responses to outbound requests would be blocked. However, by using theestablishedoption, inbound Telnet traffic arriving in response to outbound Telnet requests would be permitted, but inbound Telnet traffic trying to establish a connection would be denied.
This option is useful where it is necessary to permit some types of ICMP traffic and deny other types, instead of simply permitting or denying all types of ICMP traffic. That is, an ACE designed to permit or deny ICMP traffic can optionally include an ICMP type and code value to permit or deny an individual type of ICMP packet while not addressing other ICMP traffic types in the same ACE. As an optional alternative, the ACE can include the name of an ICMP packet type.
Syntax:
In an extended ACL using
icmpas the packet protocol type (see above), you can optionally specify an individual ICMP packet type or packet type/code pair to further define the criteria for a match. This option, if used, is entered immediately after the destination address (DA) entry. The following example shows two ACEs entered in a Named ACL context:This option identifies an individual ICMP packet type as criteria for permitting or denying that type of ICMP traffic in an ACE.
icmp-type— This value is in the range of 0 - 255 and corresponds to an ICMP packet type.
icmp-code— This value is in the range of 0 - 255 and corresponds to an ICMP code for an ICMP packet type.For more information on ICMP type names, visit the Internet Assigned Numbers Authority (IANA) website at www.iana.com, click on “Protocol Number Assignment Services”, and then go to the selections under “Internet Control Message Protocol (ICMP) Parameters”.
These name options are an alternative to the
[icmp-type [icmp-code]]methodology described above. For more information, visit the IANA website cited above.
This option is useful where it is necessary to permit some types of IGMP traffic and deny other types instead of simply permitting or denying all types of IGMP traffic. That is, an ACE designed to permit or deny IGMP traffic can optionally include an IGMP packet type to permit or deny an individual type of IGMP packet while not addressing other IGMP traffic types in the same ACE.
Syntax:
In an extended ACL using
igmpas the packet protocol type, you can optionally specify an individual IGMP packet type to further define the criteria for a match. This option, if used, is entered immediately after the destination addressing entry. The following example shows an IGMP ACE entered in the Named ACL context:The complete list of IGMP packet-type options includes:
dvmrptracemtrace-requesthost-queryv2-host-reportv3-host-reporthost-reportv2-host-leavepimmtrace-replyFor more information on IGMP packet types, visit the Internet Assigned Numbers Authority (IANA) website at www.iana.com, click on “Protocol Number Assignment Services”, and then go to the selections under “Internet Group Management Protocol (IGMP) Type Numbers”.
This section describes the commands for performing the following in a numbered, extended ACL:
This command is an alternative to using ip access-list extended < and does not use the name-str>nacl context.
Syntax:
If the ACL does not already exist, this command creates the specified ACL and its first ACE. If the ACL already exists, the new ACE is appended to the end of the configured list of explicit ACEs. In the default configuration, the ACEs in an ACL will automatically be assigned consecutive sequence numbers in increments of 10 and can be renumbered with
see Resequencing the ACEs in an ACL.resequence
NOTE: To insert a new ACE between two existing ACEs in an extended, numbered ACL:
For a match to occur, a packet must have the source and destination addressing criteria specified in the ACE, as well as:
The protocol-specific criteria configured in the ACE, including any included, optional elements (described later in this section.)
Any (optional) precedence and/or ToS settings configured in the ACE.
Specifies the ACL ID number. The switch interprets a numeric ACL with a value in this range as an extended ACL.
Specifies whether to deny (
drop) or permit (forward) a packet that matches the criteria specified in the ACE, as described below.
Specifies the packet protocol type required for a match. An extended ACL must include one of the following:
ip– any IPv4 packet.
ip-protocol– any one of the following IPv4 protocol names:
ip-in-ipospfudp*ipv6-in-ippimicmp*grevrrpigmp*espsctpahtcp** For TCP, UDP, ICMP, and IGMP, additional criteria can be specified, as described later in this section.
ip-protocol-nbr– the protocol number of an IPv4 packet type, such as "8" for Exterior Gateway Protocol or 121 for Simple Message Protocol. (For a listing of IPv4 protocol numbers and their corresponding protocol names, see the IANA "Protocol Number Assignment Services" at www.iana.com.) (Range: 0-255).
In an extended ACL, this parameter defines the source address (SA) that a packet must carry in order to have a match with the ACE.
Specifies only inbound IPv4 packets from a single address. Use this option when you want to match only the IPv4 packets from a single source address.
Specifies packets received from an SA, where the SA is either a subnet or a group of IPv4 addresses. The mask can be in either dotted-decimal format or CIDR format with the number of significant bits.
The mask is applied to the SA in the ACL to define which bits in a packet's source SA must exactly match the address configured in the ACL and which bits need not match.
Example:
10.10.10.1/24 and 10.10.10.1 0.0.0.255 both define any IPv4 address in the range of 10.10.10. (1-255).
NOTE: Specifying a group of contiguous IPv4 addresses may require more than one ACE.
Syntax:
This is the second instance of addressing in an extended ACE. It follows the first (SA) instance, described earlier, and defines the destination address (DA) that a packet must carry in order to have a match with the ACE. The options are the same as shown for
<SA>.
Specifies only the packets having
DAas the destination address. Use this criterion when you want to match only the IPv4 packets for a single DA.Specifies packets intended for a destination address, where the address is either a subnet or a group of IPv4 addresses. The mask format can be in either dotted-decimal format or CIDR format (number of significant bits).
The mask is applied to the DA in the ACL to define which bits in a packet's DA must exactly match the DA configured in the ACL and which bits need not match. See also the above example and note.
This option causes the ACE to match packets with the specified IP precedence value. Values can be entered as the following IP precedence numbers or alphanumeric names:
NOTE: The precedence criteria described in this section are applied in addition to any other selection criteria configured in the same ACE.
This option can be used after the DA to cause the ACE to match packets with the specified Type-of-Service (ToS) setting. ToS values can be entered as the following numeric settings or, in the case of 0, 2, 4, and 8, as alphanumeric names:
NOTE: The ToS criteria in this section are applied in addition to any other criteria configured in the same ACE.
An ACE designed to permit or deny TCP or UDP traffic can optionally include port number criteria for either the source or destination, or both. Use of TCP criteria also allows the established option for controlling TCP connection traffic. For a summary of the extended ACL syntax options, see Including options for TCP and UDP traffic in extended ACLs.
Syntax:
This source-port and destination-port TCP/UDP criteria is identical to the criteria described for TCP/UDP use in named, extended ACLs. See Including options for TCP and UDP traffic in extended ACLs.
This command is useful where it is necessary to permit some types of ICMP traffic and deny other types, instead of simply permitting or denying all types of ICMP traffic. That is, an ACE designed to permit or deny ICMP traffic can optionally include an ICMP type and code value to permit or deny an individual type of ICMP packet while not addressing other ICMP traffic types in the same ACE. As an optional alternative, the ACE can include the name of an ICMP packet type.
Syntax:
This command is useful where it is necessary to permit some types of IGMP traffic and deny other types, instead of simply permitting or denying all types of IGMP traffic. That is, an ACE designed to permit or deny IGMP traffic can optionally include an IGMP packet type to permit or deny an individual type of IGMP packet while not addressing other IGMP traffic types in the same ACE. As an optional alternative, the ACE can include the name of an ICMP packet type.