HP PROCURVE 2910AL, Руководство по обеспечению безопасности доступа

Страница: 370 / 594

IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
Note
After a numbered ACL has been created (using access-list < 1 - 99 | 100 - 199 > ),
it can be managed as either a named or numbered ACL. For example, in an
existing ACL with a numeric identifier of “115”, either of the following com­
mand sets adds an ACE denying IP traffic from any IP source to a host at
10.10.10.100:
ProCurve(config)# access-list 115 deny ip host
10.10.10.100
ProCurve(config)# ip access-list extended 115
ProCurve(config-ext-nacl)# deny ip any 10.10.10.100
Appending Remarks and Related ACEs to the End of an ACL. To
include a remark for an ACE that will be appended to the end of the current
ACL, enter the remark first, then enter the related ACE. This results in the
remark and the subsequent ACE having the same sequence number. For
example, to add remarks using the “Named-ACL” (
nacl
) context:
ProCurve(config)# ip access-list standard My-List
ProCurve(config-std-nacl)# permit host 10.10.10.15
ProCurve(config-std-nacl)# deny 10.10.10.1/24
ProCurve(config-std-nacl)# remark HOST-10.20.10.34
The remark is assigned the same
ProCurve(config-std-nacl)# permit host 10.20.10.34
number that the immediately
ProCurve(config-std-nacl)# show run
following ACE (“30” in this example)
is assigned when it is automatically
. . .
appended to the end of the list. This
hostname "ProCurve"
operation applies where new
ip access-list standard "My-List"
remarks and ACEs are appended to
10 permit 10.10.10.15 0.0.0.0
the end of the ACL and are
automatically assigned a sequence
number.
20 deny 10.10.10.1 0.0.0.255
30 remark "HOST-10.20.10.34"
30 permit 10.20.10.34 0.0.0.0
exit
Figure 9-23. Example of Appending a Remark and Its Related ACE to the End of an ACL
(You can also perform the operation illustrated in figure 9-23 by using the
numbered,
access-list < 1 - 99 | 100 - 199 > syntax shown at the beginning of this
section.)
9-82