Example Of Using The Offline Process - HP 3500yl Series Access Security Manual

IPv4 Access Control Lists (ACLs)
Creating or Editing ACLs Offline
no ip access-list extended List-120
ip access-list extended "List-120"
10 remark "THIS ACE ALLOWS TELNET"
10 permit tcp 10.30.133.27 0.0.0.0 eq 23 0.0.0.0 255.255.255.255
20 deny ip 10.30.133.1 0.0.0.255 0.0.0.0 255.255.255.255
30 deny ip 10.30.155.1 0.0.0.255 0.0.0.0 255.255.255.255
40 remark "THIS IS THE FINAL ACE IN THE LIST"
40 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
exit
Figure 10-39. Example of an Offline ACL File Designed To Replace An Existing ACL
10-108
If you are replacing an ACL on the switch with a new ACL that uses the
same number or name syntax, begin the command file with a no ip access-
list command to remove the earlier version of the ACL from the switch's
running-config file. Otherwise, the switch will append the new ACEs in
the ACL you download to the existing ACL. For example, if you planned
to use the copy command to replace ACL "List-120", you would place this
command at the beginning of the edited file:
no ip access-list extended List-120
3. Use copy tftp command-file to download the file as a list of commands to
the switch.

Example of Using the Offline Process

For example, suppose that you wanted to create an extended ACL for an RACL
application to fulfill the following requirements (Assume a subnet mask of
255.255.255.0 and a TFTP server at 10.10.10.1.):
■ ID: "LIST-20-IN"
Deny Telnet access to a server at 10.10.10.100 on VLAN 10 from these
■
three addresses on VLAN 20 (with ACL logging):
• 10.10.20.17
• 10.10.20.23
• 10.10.20.40
■ Allow any access to the server from all other addresses on VLAN 20:
Permit internet access to these two address on VLAN 20, but deny
■
access to all other addresses on VLAN 20 (without ACL logging).
• 10.10.20.98
• 10.10.20.21
Removes an existing ACL
and replaces it with a
new version with the
same identity. To append
new ACEs to an existing
ACL instead of replacing
it, you would omit the first
line and ensure that the
sequence numbering for
the new ACEs begin with
a number greater than
the highest number in the
existing list.