HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 473 / 732

10-93
IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
Note
After a numbered ACL has been created (using access-list < 1 - 99 | 100 - 199 > ),
it can be managed as either a named or numbered ACL. For example, in an
existing ACL with a numeric identifier of “115”, either of the following com-
mand sets adds an ACE denying IPv4 traffic from any source to a host at
10.10.10.100:
HP Switch(config)# access-list 115 deny ip host
10.10.10.100
HP Switch(config)# ip access-list extended 115
HP Switch(config-ext-nacl)# deny ip any 10.10.10.100
Appending Remarks and Related ACEs to the End of an ACL. To
include a remark for an ACE that will be appended to the end of the current
ACL, enter the remark first, then enter the related ACE. This results in the
Syntax: ip access-list < standard | extended > < name-str | 1-99 | 100-199 >
[ seq-# ] remark < remark-str >
no < seq-# > remark
This syntax applies to both named and numbered ACLs. With-
out an optional sequence number, the remark is appended to
the end of the list and automatically assigned a sequence
number. When entered with an optional sequence number, the
remark is inserted in the list according to the numeric prece-
dence of the sequence number. The
no form of the command
deletes the indicated remark, but does not affect the related
ACE.
To associate a remark with a specific ACE, enter the remark first,
and then enter the ACE.
– Entering a remark without a sequence number and then
entering an ACE without a sequence number results in the
two entries being automatically paired with the same
sequence number and appended to the end of the current ACL.
– Entering a remark with a sequence number and then
entering an ACE with the same sequence number results in
the two entries being paired together and positioned in the
list according to the sequence number they share.