HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 468 / 778

10-48
IPv4 Access Control Lists (ACLs)
Configuring and Assigning an IPv4 ACL
Using the CLI To Create an ACL
You can use either the switch CLI or an offline text editor to create an ACL.
This section describes the CLI method, which is recommended for creating
short ACLs. (To use the offline method, refer to “Creating or Editing ACLs
Offline” on page 10-107.)
General ACE Rules
These rules apply to all IPv4 ACEs you create or edit using the CLI:
■ Inserting or adding an ACE to an ACL:
• Named IPv4 ACLs: Add an ACE to the end of a named ACE by using
the ip access-list command to enter the Named ACL ( nacl ) context
and entering the ACE without the sequence number. For example, if
you wanted to add a “permit” ACL at the end of a list named “List-1”
to allow traffic from the device at 10.10.10.100:
HP Switch(config)# ip access-list standard List-1
HP Switch(config-std-nacl)# permit host
10.10.10.100
Insert an ACE anywhere in a named ACL by specifying a sequence
number. For example, if you wanted to insert a new ACE as line 15
between lines 10 and 20 in an existing ACL named “List-2” to deny
IPv4 traffic from the device at 10.10.10.77:
HP Switch(config)# ip access-list standard List-2
HP Switch(config-std-nacl)# 15 deny host
10.10.10.77
• Numbered IPv4 ACLs: Add an ACE to the end of a numbered ACL
by using the
access-list < 1 - 99 | 100 - 199 >
command. For example, if
you wanted to add a “permit” ACE at the end of a list identified with
the number “11” to allow IPv4 traffic from the device at 10.10.10.100:
HP Switch(config)# access-list 11 permit host
10.10.10.100
Command Page
access-list (standard ACLs) 10-50
access-list (extended ACLs) 10-59