HP 2530 User Manual

SubtaskTaskParameter
within a single subnet. The prefix length in
CIDR format defines the number of leftmost bits
to use in determining a match. See “Using
CIDR notation to enter the IPv6 ACL prefix
length” (page 80). In a given ACE, the DA
prefix-length defines how many leftmost
bits in a packet's DA must exactly match the
DA configured in the ACE.
Use this option after the DA to generate
an Event Log message if:
log
• The action is deny. (Does not apply to
permit actions.)
• There is a match.
• ACL logging is enabled. See “Enabling ACL
logging on the switch” (page 106).
TCP and UDP traffic in IPv6 ACLs
An ACE designed to permit or deny TCP or UDP traffic can optionally include port number criteria
for either the source, the destination, or both. Using TCP criteria also enables the established
option for controlling TCP connection traffic.
TCP :
<deny | permit> tcp
<SA> [comparison-operator <tcp-src-port>]
<DA> [comparison-operator <tcp-dest-port>]
[established]
[ack] [fin] [rst] [syn]
UDP :
<deny | permit> udp
<SA> [comparison-operator <udp-src-port>]
<DA> [comparison-operator <udp-dest-port>]
In an IPv6 ACL using either tcp or udp as the IP packet protocol type, you can
optionally apply comparison operators specifying TCP or UDP source or destination
port numbers or ranges of numbers to further define the criteria for a match. For
example:
#deny tcp host fe80::119 eq 23 host fe80::155
established
#permit tcp host 2001:db8::10.100 host
2001:db8::15:12 eq telnet
#deny udp 2001:db8::ad5:1f4 host 2001:db8::ad0:ff3
range 161 162
[comparison-operator <tcp/udp-src-port>]
To specify a TCP or UDP source port number in an ACE:
1. Select a comparison operator from the following list.
2. Enter the port number or a well-known port name.
Configuration commands 83

HP 2530 Specifications

General

Layer	Layer 2
Operating Temperature	32°F to 113°F (0°C to 45°C)
Model	HP 2530
Power over Ethernet (PoE)	PoE+
Management	Web interface, CLI, SNMP
Memory	128 MB flash
Input Voltage	100-240 VAC
Jumbo Frame Support	Yes
Operating Humidity	15% to 95% non-condensing

Summary

1 Updates for the HP Switch Software Access Security Guide

Configuring advanced threat protection

Covers advanced threat protection features like DHCP snooping, Dynamic ARP protection, and Instrumentation monitor.

DHCP snooping

Details DHCP snooping for preventing DoS attacks by distinguishing trusted and untrusted ports.

Dynamic ARP protection

Explains how to protect networks from ARP poisoning attacks using dynamic ARP protection.

Dynamic IP Lockdown

This feature prevents IP source address spoofing by enforcing IP-to-MAC bindings.

Using the instrumentation monitor

How to use the instrumentation monitor to detect security anomalies and irregular operations.

Configuring RADIUS server support for switch services

Introduction

Explains configuring CoS, rate-limiting, and ACL client services via a RADIUS server.

Configuring and using dynamic (RADIUS-assigned) access control lists

Describes applying RADIUS-assigned ACLs to filter IP traffic from authenticated clients.

2 Updates for the HP Switch Software IPv6 Configuration Guide

Access Control Lists (ACLs)

Details configuring, applying, and editing static IPv6 ACLs for traffic filtering.

ACL applications

Covers filtering traffic from hosts, subnets, and applying ACLs at network edges.

RADIUS-assigned ACLs

Explains ACLs configured on a RADIUS server and assigned to authenticated clients.

Planning and configuring ACLs

Outlines steps for identifying ACL actions, designing ACLs, and applying them.

ACL operation

Describes how ACLs apply to ports, trunks, and filter traffic types.

Guidelines for planning ACL structure

Covers determining ACL application points and the order of ACEs for resource efficiency.

ACL configuration structure

Details the basic structure of an ACL, including identity, remarks, and ACEs.