HP E3800 Series, Руководство по обеспечению безопасности доступа

Страница: 475 / 732

10-95
IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
Inserting a Remark for an ACE that Already Exists in an ACL. If a
sequence number is already assigned to an ACE in a list, you cannot insert a
remark by assigning it to the same number. (To configure a remark with the
same number as a given ACE, the remark must be configured first.) To assign
a remark to the same number as an existing ACE:
1. Delete the ACE.
2. Configure the remark with the number you want assigned to the pair.
3. Re-Enter the deleted ACE with the number used to enter the remark.
Removing a Remark from an Existing ACE. If you want to remove a
remark, but want to retain the ACE, do the following:
1. Use the Named ACL context to enter the ACL.
2. Using show run or show access-list < list-name > config , note the sequence
number and content of the ACE having a remark you want to remove.
3. Delete the ACE.
4. Using the same sequence number, re-enter the ACE.
Operating Notes for Remarks
■ The resequence command ignores “orphan” remarks that do not have
an ACE counterpart with the same sequence number. For example, if:
• a remark numbered “55” exists in an ACE
• there is no ACE numbered “55” in the same ACL
•
resequence
is executed on an ACL
then the remark retains “55” as its sequence number and will be placed in
the renumbered version of the ACL according to that sequence number.
■ Entering an unnumbered remark followed by a numbered ACE, or the
reverse, creates an “orphan” remark. The unnumbered entry will be
assigned a sequence number that is an increment from the last ACE
in the list. The numbered entry will then be placed sequentially in the
list according to the sequence number used.
■ Configuring two remarks without either sequence numbers or an
intervening, unnumbered ACE results in the second remark over-
writing the first.