Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a single HP ProCurve 2610 in a remote location that is connected in with the rest of the network via SHDSL. There are two Layer-3 networks on this segment. ACLs are setup to deny one subnet ( from ever being able to leave the switch by virtue of being applied to port attached to the upstream connection. The other subnet should be permitted to freely leave the switch. Both subnets are on the same VLAN.

Unfortunately SFlow very clearly show broadcast traffic from on the upstream connection. ProCurve ACLs are not my strong suit but I feel like I'm missing something very simple here.

ip access-list extended "Filter for Camera Network" 
   deny ip log 
   permit ip 

interface 24 
   name "DSL - UPLINK" 
   access-group "Filter for Camera Network" in

Unless I am mistaken traffic from should be dropped as it crosses the uplink port (int 24) whereas all other traffic will be permited by the following default allow rule.

What exactly am I missing here?


Firstly, why do you have two subnets contained in the same VLAN?

Because that's how it was configured by a previous administrator and while it makes conceptual sense that a single subnet is "mapped" to a single VLAN there's no technical constraint that I am aware of that makes this have to be the case.

Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic.

The HP2600 series can only filter inbound traffic on interfaces. Should I change my filter to deny any to

share|improve this question
No, changing your filter to deny any to would block any externally initiated connections to In order to block that subnet from getting out of that interface, you need to filter outbound traffic. – HostBits Jun 27 '12 at 17:17

Firstly, why do you have two subnets contained in the same VLAN?. Although, that's not your problem here. I can't speak to the syntax of the commands as I haven't configured HP ProCurves, but it seems your logic is off. Instead of filtering inbound traffic on your uplink, you should be filtering outbound traffic. The uplink interface wouldn't receive traffic from that subnet, it would pass traffic through.

share|improve this answer
Please see my edit. – kce Jun 27 '12 at 16:45

The simple answer is reconfigure the Layer3 device providing routing to NOT have an interface or secondary IP in the subnet that you don't want to leave the switch. If there is no layer 3 route from/to that subnet then traffic will only exist in the layer2 switching environment of the switch for that subnet.

Edit: if it has an uplink to another switch you can filter the subnet on THAT switch inbound.

share|improve this answer

If you're right about the traffic filters on the 2610 (it's been a while since i've looked at them), then you should be adding this filter on the individual ports which are part of that address range. Filtering traffic on the uplink would only work if the 2610 supports outbound filters.

Presumably you've got a server collecting the camera data on the same VLAN? In that case, you'll probably also need an extra rule in there which allows to, and you probably don't want to apply the ACL to the server port, otherwise you won't be able to access it remotely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.