A5800 and ACLs (1767 Views)
Valued Contributor
Posts: 192
Registered: ‎01-30-2012
Message 1 of 4 (1,767 Views)

A5800 and ACLs

I am relatively new to ACLs on this switch module and I was hoping someone could help me understand what I have to do to apply an ACL to a pair of VLANs.


Currently I have a internally designated VLAN and a dmz designated VLAN and traffic is permitted to pass between them. I would like to stop this behavior with the exception of a few ports/protocols, but for now a simple block all will be sufficient. 


My internally desginated vlan is and my dmz desginated VLAN is Both are 24 bit subnets. 


I've created the following acl:


acl number 3000
 rule 0 deny ip source 0 destination 0


Now, according to some of the documentation I've read I have to do something with traffic classifier? Is this correct? Any info on what my next step should be would be awesome. Thanks in advance. 

Valued Contributor
Posts: 192
Registered: ‎01-30-2012
Message 2 of 4 (1,765 Views)

Re: A5800 and ACLs

Ok so I setup some tests and I got working what I need to work. This was accomplished by the following procedure:


acl number 3000
 rule 0 deny ip source destination
interface GigabitEthernet1/0/1
 packet-filter 3000 inbound
 packet filter 3000 outbound

 Now I want to make some rules for specific hosts with specific tcp ports. Is there a way to combine tcp ports into one? For example if I want to allow 80 and 443 to host, what would the rule look like?

acl number 3000
 rule 0 deny ip source destination
 rule 1 permit tcp source destination destination-port eq 80,443


Occasional Advisor
Posts: 10
Registered: ‎03-14-2012
Message 3 of 4 (1,754 Views)

Re: A5800 and ACLs

I'm not sure about combining multiple ports into one statement, remember you can simply add a separate rule with the new destination port below the first.


In your example however, I believe this won't work because the ACL is applied based on rule number. So it will apply rule 0 first - Denying everything, and dropping the traffic. You need the most specific statements at the top of the ACL and the 'catch all' ones at the bottom. The explicit deny should usually be at the bottom of the ACL rules set.


Make rule 0 equal to rule 20, and specify the others to start with rule 5.. 10 etc. If you leave spaces then it makes it easier to modify the ACL later on.





Respected Contributor
Posts: 818
Registered: ‎06-08-2009
Message 4 of 4 (1,743 Views)

Re: A5800 and ACLs

ACLs are usually one to one.   Usually you do your deny rules first and then the last rule is a implicit permit to allow any traffic not covered under deny rules as allowed.   I would not try to combine port rules together in one rule.  I would have separate rules for each so you can analyze traffic problems easier. 





The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.