R3204P16-HP Load Balancing Module Security Configuration Guide-6PW101

Automatic rule numbering and renumbering

The ID automatically assigned to an ACL rule takes the nearest higher multiple of the numbering step to

the current highest rule ID, starting with 0.

For example, if the numbering step is 5 (the default), and there are five ACL rules numbered 0, 5, 9, 10,

and 12, the newly defined rule is numbered 15. If the ACL does not contain any rule, the first rule is

numbered 0.

Whenever the step changes, the rules are renumbered, starting from 0. For example, if there are five rules

numbered 5, 10, 13, 15, and 20, changing the step from 5 to 2 causes the rules to be renumbered 0, 2,

4, 6 and 8.

Fragments filtering with ACLs

Traditional packet filtering matches only first fragments of packets, and allows all subsequent non-first

fragments to pass through. Attackers can fabricate non-first fragments to attack networks.

To avoids the risks, the HP ACL implementation:

• Filters all fragments by default, including non-first fragments.

• Allows for matching criteria modification, for example, filters non-first fragments only.

ACL acceleration

ACL acceleration speeds up ACL lookup. The acceleration effect increases with the number of ACL rules.

ACL acceleration uses memory. To achieve the best trade-off between memory and ACL processing

performance, HP recommends you enable ACL acceleration for large ACLs.

For example, when you use a large ACL for a session-based service, such as NAT, you can enable ACL

acceleration to avoid session timeouts caused by ACL processing delays.

Enable ACL acceleration in an ACL after you have finished editing ACL rules. ACL acceleration always

uses ACL criteria that have been set before it is enabled for rule matching. It does not synchronize with

any subsequent match criterion changes.

Configuring an ACL in the web

Configuration task list

Perform the tasks in Table 21 to configure an ACL.

Table 21 ACL configuration task list

Task Remarks

Configuring a time range Optional

Creating an ACL

Required

The category of the created ACL depends on the ACL number that you

specify.