HP A7533A - Brocade 4Gb SAN Switch Base, Administrator'S Manual

Page: 141 / 576

Fabric OS 6.2 administrator guide 139
Deleting a rule to an IP Filter policy
Deleting a rule in the specified IP Filter policy causes the rules following the deleted rule to shift up in rule
order. The change to the specified IP Filter policy is not saved to persistent configuration until a save or
activate subcommand is run.
1. Log in to the switch using an account assigned to the admin role.
2. Enter the following command:
ipfilter –-delrule <policyname> -rule <rule number>
Aborting a transaction associated with IP Filter
A transaction is associated with a command line or manageability session. It is opened implicitly when the
--
create
,
--
addrule
,
--
delrule
,
--
clone
, and
--
delete
subcommands are run. The
--transabort
,
--save
, or
--activate
subcommands explicitly end the transaction owned by the
current command line or manageability session. If a transaction is not ended, other command line or
manageability sessions are blocked on the subcommands that would open a new transaction.
1. Log in to the switch using an account assigned to the admin role.
2. Enter the following command:
ipfilter –-transabort
IP Filter policy distributions
The IP Filter policy is manually distributed using the
distribute -p “IPFILTER”
command. The
distribution includes both active and defined IP Filter policies. All policies are combined as a single entity
to be distributed and cannot be selectively distributed. However, you may choose the time at which to
implement the policy for optimization purposes. If a distribution includes an active IP Filter policy, the
receiving switches activate the same IP Filter policy automatically. When a switch receives IP Filter policies,
all uncommitted changes left in its local transaction buffer are lost, and the transaction is aborted.
Switches with Fabric OS 5.3.0 or later have the ability to accept or deny IP Filter policy distribution,
through the commands
fddCfg
--
localaccept or fddCfg
--
localreject
. However, automatic
distribution of IP Filter policy through Fabric Wide Consistent Policy is not supported in Fabric OS 6.2.0.
See ” Policy database distribution ” on page 139 for more information on distributing the IP Filter policy.
IP Filter policy restrictions
In a mixed fabric with Fabric OS 5.3.0 or later and pre-5.3.0 switches, IP Filter policies cannot be
distributed from a Fabric OS 6.2.0 switch to a pre-5.3.0 switch. This means that the sending switch will fail
a
distribute -p “IPFILTER”
operation, if the specified receiving domain list contains switches with
Fabric OS 5.2.0 and earlier. When the asterisk (*) is used as the receiving domain, the sending switch
distributes the IP Filter policies only to switches with Fabric OS 5.3.0 or later.
Policy database distribution
Fabric OS lets you manage and enforce the ACL policy database on either a per-switch or fabric-wide
basis. The local switch distribution setting and the fabric-wide consistency policy affect the switch ACL
policy database and related distribution behavior.
-rule rule number
Specifies a valid rule number between 1 and the current maximum rule
number plus 1.
-sip source IP
Specifies the source IP address. For IPv4 filter type, the address must be a
32-bit address in dot decimal notation, or a CIDR block IPv4 prefix. For
IPv6 filter type, the address must be a 128-bit IPv6 address in any format
specified by RFC, or a CIDR block IPv6 prefix.
-dp destination port
Specifies the destination port number, or a range of port numbers, or a
service name.
-proto protocol
Specifies the protocol type, either TCP or UDP.
-act <permit | deny>
Specifies the permit or deny action associated with this rule.