HP 6200YL - Manual (Page 201)

IPv6 Access Control Lists (ACLs)
IPv6 ACL Operation
implementing an ACL depends in part on configuring ACEs in the correct
order for the overall policy you want the ACL to enforce
.
Is there a
match?
Perform action
(permit or deny).
No
Test a packet against
criteria in first ACE.
Yes
No
Yes
Deny the packet
(invoke an Implicit
Deny).
End
Perform action
(permit or deny).
End
End
Test the packet against
criteria in second ACE.
Is there a
match?
Test packet against
criteria in Nth ACE.
Is there a
match?
No
Yes
End
Perform action
(permit or deny).
1. If a match is not found with
the first ACE in an ACL, the
switch proceeds to the next
ACE and so on.
2. If a match with an explicit
ACE is subsequently found,
the packet is either permit­
ted (forwarded) or denied
(dropped), depending on
the action specified in the
matching ACE. In this case
the switch ignores all sub­
sequent ACEs in the ACL.
3. If a match is not found with
any explicit ACE in the ACL,
the switch invokes the
Implicit Deny at the end of
every ACL, and drops the
packet.
Note: If the list includes an
ACE configured with Permit
Any forwarding, no packets
can reach the Implicit Deny
at the end of the list. Also,
placing an ACE with Permit
Any forwarding at any point
in an ACL defeats the
purpose of any subsequent
ACEs in the list.
Figure 8-4. The Packet-Filtering Process in an ACL with N Entries (ACEs)
N o t e The order in which an ACE occurs in an ACL is significant. For example, if an
ACL contains six ACEs, but the first ACE allows “Permit Any” forwarding,
then the ACL permits all IPv6 traffic, and the remaining ACEs in the list do not
apply, even if they have a match with any traffic permitted by the first ACE.
For example, suppose you want to configure an ACL (with an ID of “Test-02”)
to invoke these policies for IPv6 traffic entering the switch on VLAN 100:
8-25