KB.15.15

Figure 183 Standard, numbered ACL with the same ACEs as the standard, named ACL in Figure 181

(page 260)

Configuring extended ACLs

Standard ACLs use only source IPv4 addresses for filtering criteria, extended ACLs use multiple

filtering criteria. This enables you to more closely define your IPv4 packet-filtering.

Extended ACLs enable filtering on source and destination IPv4 addresses (required), in one of the

following options:

• Source and destination IPv4 addresses for filtering criteria, extended ACLs use multiple filtering

criteria. This enables you to more closely define your IPv4 packet filtering. Extended ACLs

enable filtering on the following:

◦ specific host

◦ subnet or group of addresses

◦ any address

• choice of any IPv4 protocol

• optional packet-type criteria for IGMP, and ICMP traffic

• optional source and/or destination TCP or UDP port, with a further option for comparison

operators and (for TCP) an option for establishing connections

• filtering for TCP traffic based on either TCPcontrol bits or whether the subject traffic is initiating

a connection ("established" option)

• optional IP precedence and ToS criteria

HP Switches allow up to 2048 ACLs in any combination of IPv4 and IPv6 ACLs, and determine

the total from the number of unique identifiers in the configuration. For example, configuring two

ACLs results in an ACL total of two, even if neither is assigned to an interface. If you then assign

a nonexistent ACL to an interface, the new ACL total is three, because the switch now has three

unique ACL names in its configuration.

Creating and configuring a named, extended ACL

For a match to occur with an ACE in an extended ACL, a packet must have the source and

destination address criteria specified by the ACE, as well as any IPv4 protocol-specific criteria

included in the command.

Use the following general steps to create or add to a named, extended ACL:

Configuring 263