HP HP ProCurve Series 6600, Руководство по обеспечению безопасности доступа

Страница: 508 / 778

10-88
IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
For example, to append a fourth ACE to the end of the ACL in figure 10-23:
Figure 10-25. Example of Appending an ACE to an Existing List
N o t e
When using the access-list < 1 - 99 | 100 - 199 > < permit | deny > < SA > command
to create an ACE for a numbered ACL, the ACE is always added to the end of
the current list and given the appropriate sequence number. However, once a
numbered list has been created, you can use the
ip access-list command to
open it as a named ACL and specify a nondefault sequence number, as
described in the next section.
Inserting an ACE in an Existing ACL
This action uses a sequence number to specify where to insert a new ACE into
an existing sequence of ACLs.
HP Switch(config)# ip access-list standard My-List
HP Switch(config-std-nacl)# permit any
HP Switch(config-std-nacl)# show run
.
.
.
ip access-list standard "My-List"
10 permit 10.10.10.25 0.0.0.0
20 permit 10.20.10.117 0.0.0.0
30 deny 10.20.10.1 0.0.0.255
40 permit 0.0.0.0 255.255.255.255
exit
Syntax: ip access-list < standard | extended > < name-str | 1 - 99 | 100 - 199 >
<1-2147483647> < permit | deny > < standard-acl - ip-criteria > [ log ]
<1-2147483647> < permit | deny > < extended-acl-ip-criteria > [ options ]
The first command enters the “Named-ACL” context for the
specified ACL. The remaining two commands insert a new
ACE in a standard or extended ACL, respectively. (For details
on these criteria and options, refer to table , “Command
Summary for Standard IPv4 ACLs” —page 10-5, and table ,
“Command Summary for IPv4 Extended ACLs” —page 10-6.)
Note: Entering an ACE that would result in an out-of-range
sequence number is not allowed. Use the resequence
command to free up ACE numbering availability in the
ACL. Refer to “Resequencing the ACEs in an ACL” on
page 10-91.