HP PROCURVE 2910AL, Руководство по обеспечению безопасности доступа

Страница: 372 / 594

IPv4 Access Control Lists (ACLs)
Editing an Existing ACL
Operating Notes for Remarks
■ The
resequence
command ignores “orphan” remarks that do not have
an ACE counterpart with the same sequence number. For example, if:
• a remark numbered “55” exists in an ACE
• there is no ACE numbered “55” in the same ACL
• resequence is executed on an ACL
then the remark retains “55” as its sequence number and will be placed in
the renumbered version of the ACL according to that sequence number.
■ Entering an unnumbered remark followed by a numbered ACE, or the
reverse, creates an “orphan” remark. The unnumbered entry will be
assigned a sequence number that is an increment from the last ACE
in the list. The numbered entry will then be placed sequentially in the
list according to the sequence number used.
■ Configuring two remarks without either sequence numbers or an
intervening, unnumbered ACE results in the second remark over­
writing the first.
ProCurve(config)# ip access-list standard Accounting
ProCurve(config-std-nacl)# permit host 10.10.10.115
ProCurve(config-std-nacl)# deny 10.10.10.1/24
ProCurve(config-std-nacl)# show run
Where multiple remarks are
sequentially entered for
.
automatic inclusion at the end of
.
an ACL, each successive remark
.
replaces the previous one until an
ip access-list standard "Accounting"
10 permit 10.10.10.115 0.0.0.0
ACE is configured for automatic
inclusion at the end of the list.
20 deny 10.10.10.1 0.0.0.255
30 remark "Channel_Mktg"
exit
ProCurve(config-std-nacl)# remark Marketing
ProCurve(config-std-nacl)# remark Channel_Mktg
Figure 9-25. Example of Overwriting One Remark with Another
9-84