Cabletron Systems SSIM-R8-02 Specifikace stáhnout pdf (Strana 305)

Enterasys Xpedition User Reference Manual 285

Creating and Modifying ACLs

Editing ACLs Offline

You can create and edit ACLs on a remote host and then upload them to the XP with TFTP

or RCP. With this method, you use a text editor on a remote host to edit, delete, replace, or

reorder ACL rules in a file. Once the changes are made, you can then upload the ACLs to

the XP using TFTP or RCP and make them take effect on the running system. The

following example describes how you can use TFTP to help maintain ACLs on the XP.

Suppose the following ACL commands are stored in a file on some hosts:

The first command, no acl *, negates all commands that start with the keyword, “acl”.

This tells the XP to remove the application and the definition of any ACL. You can be more

selective if you want to remove only ACL commands related to, for instance, ACL 101 by

entering, no acl 101 *. The negation of all related ACL commands is important because it

removes any potential confusion caused by the addition of new ACL rules to existing

rules. Basically, the no acl command cleans up the system for the new ACL rules.

Once the negation command is executed, the second and the third commands proceed to

redefine ACL 101. The final command applies the ACL to interface int12.

If the changes are accessible from a TFTP server, you can upload and make the changes

take effect by issuing commands like the following:

The first copy command uploads the file acl.changes from a TFTP server and puts the

commands into the temporary configuration area, the scratchpad. The administrator can

re-examine the changes if necessary before committing the changes to the running system.

The second copy command makes the changes take effect by copying from the scratchpad

to the active running system.

If you need to re-order or modify the ACL rules, you must make the changes in the

acl.changes file on the remote host, upload the changes, and make them effective again.

Maintaining ACLs Using the ACL Editor

In addition to the traditional method of maintaining ACLs using TFTP or RCP, the XP

provides a simpler and more user-friendly mechanism to maintain ACLs: the ACL Editor.

The ACL Editor can only be accessed within Configure mode using the acl-edit

command. You edit an ACL by specifying its name together with the acl-edit command.

no acl *

acl 101 deny tcp 10.11.0.0/16 10.12.0.0/16

acl 101 permit tcp 10.11.0.0 any

acl 101 apply interface int12 input

ssr# copy tftp://10.1.1.12/config/acl.changes to scratchpad

ssr# copy scratchpad to active

1 2 ... 300 301 302 303 304 305 306 307 308 309 310 ... 393 394

Žádné komentáře

Cabletron Systems SSIM-R8-02 Specifikace Strana 305