Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-39
Introduction
ProCurve Wireless Edge Services xl Module
You can create the following types of ACLs:
■ MAC standard ACLs
■ MAC extended ACLs
■ standard IP ACLs
■ extended IP ACLs
As discussed in “MAC Authentication” on page 1-27, MAC standard ACLs filter
traffic according to the source MAC address. These ACLs act as authentica-
tion: rather than control which network services a user can access, MAC ACLs
either allow or block traffic from a station entirely.
MAC extended ACLs, like MAC standard ACLs, filter traffic according to
information in the Layer 2 header. However, the extended ACL provides many
more options for filters, including destination MAC address, 802.1p priority
value, and the type of encapsulated protocol. For example, you can permit
IPv4 traffic but drop IPv6 traffic.
The IP ACLs operate at Layer 3. A standard IP ACL filters traffic according to
source IP address only. An extended IP ACL, on the other hand, examines many
fields in the Layer 3 IP header and even the Layer 4 TCP or UDP header. For
example, an extended IP ACL could select traffic associated with a particular
application by specifying the destination TCP or UDP port for that application.
Table 1-3 compares the various types of ACLs.
Table 1-3. ACL Types
Functionality Standard IP ACLs Extended IP ACLs MAC Standard ACLs MAC Extended ACL
Operates at Layer 3 Layer 3/4 Layer 2 Layer 2
Filters traffic
according to
source address • source address
• destination address
•protocol
• TCP or UDP source
port or destination
port
• ICMP type
source address • source address
• destination address
• encapsulated
protocol
Applies to traffic
on
• individual VLAN
interface
• physical interface
(uplink or
downlink port)
• individual VLAN
interface
• physical interface
(uplink or downlink
port)
physical interface (uplink
or downlink port)
physical interface (uplink
or downlink port)