HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 474 / 732

10-94
IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
remark and the subsequent ACE having the same sequence number. For
example, to add remarks using the “Named-ACL” (
nacl
) context:
Figure 10-30. Example of Appending a Remark and Its Related ACE to the End of an ACL
(You can also perform the operation illustrated in figure 10-30 by using the
numbered,
access-list < 1 - 99 | 100 - 199 >
syntax shown at the beginning of this
section.)
Inserting Remarks and Related ACEs Within an Existing List.
To
insert an ACE with a remark within an ACL by specifying a sequence number,
insert the numbered remark first, then, using the same sequence number,
insert the ACE. (This operation applies only to ACLs accessed using the
“Named-ACL” (
nacl ) context.) For example:
HP Switch(config)# ip access-list standard My-List
HP Switch(config-std-nacl)# permit host 10.10.10.15
HP Switch(config-std-nacl)# deny 10.10.10.1/24
HP Switch(config-std-nacl)# remark HOST-10.20.10.34
HP Switch(config-std-nacl)# permit host 10.20.10.34
HP Switch(config-std-nacl)# show run
. . .
hostname "HP Switch"
ip access-list standard "My-List"
10 permit 10.10.10.15 0.0.0.0
20 deny 10.10.10.1 0.0.0.255
30 remark "HOST-10.20.10.34"
30 permit 10.20.10.34 0.0.0.0
exit
The remark is assigned the same
number that the immediately
following ACE (“30” in this example)
is assigned when it is automatically
appended to the end of the list. This
operation applies where new
remarks and ACEs are appended to
the end of the ACL and are
automatically assigned a sequence
number.
HP Switch(config-std-nacl)# 15 remark "HOST 10.10.10.21"
HP Switch(config-std-nacl)# 15 permit host 10.10.10.21
HP Switch(config-std-nacl)# show run
ip access-list standard "My-List"
10 permit 10.10.10.15 0.0.0.0
15 remark "HOST 10.10.10.21"
15 permit 10.10.10.21 0.0.0.0
20 deny 10.10.10.1 0.0.0.255
30 remark "HOST-10.20.10.34"
30 permit 10.20.10.34 0.0.0.0
exit
Inserting a remark/ACE pair with
the same sequence number
requires that the remark (with
the desired sequence number)
be inserted
before the ACE with
the same number.