Creating And Modifying Acls; Editing Acls Offline - Cabletron Systems IA1100 User's Reference Manual

Chapter 13: Access Control List Configuration Guide
The following ACL illustrates this feature:
acl 101 permit tcp established
acl 101 apply interface int1 input
Any incoming TCP packet on interface int1 is examined, and if the packet is in response to
an internal request, it is permitted; otherwise, it is rejected. Note that the ACL contains no
restriction for outgoing packets on interface int1, since internal hosts are allowed to access
the outside world.

Creating and Modifying ACLs

The IA provides two mechanisms for creating and modifying ACLs:
• Editing ACLs on a remote host and uploading them to the IA using TFTP or RCP
• Using the IA's ACL Editor
The following sections describe these methods.

Editing ACLs Offline

You can create and edit ACLs on a remote host and then upload them to the IA with TFTP
or RCP. With this method, you use a text editor on a remote host to edit, delete, replace, or
reorder ACL rules in a file. Once the changes are made, you can then upload the ACLs to
the IA using TFTP or RCP and make them take effect on the running system. The
following example describes how you can use TFTP to help maintain ACLs on the IA.
Suppose the following ACL commands are stored in a file on some hosts:
no acl *
acl 101 deny tcp 10.11.0.0/16 10.12.0.0/16
acl 101 permit tcp 10.11.0.0 any
acl 101 apply interface int12 input
The first command, no acl *, negates all commands that start with the keyword acl. This
tells the IA to remove the application and the definition of any ACL. You can be more
selective if you want to remove only ACL commands related to, for instance, ACL 101 by
entering, no acl 101 *. The negation of all related ACL commands is important because it
removes any potential confusion caused by the addition of new ACL rules to existing
rules. Basically, the no acl command cleans up the system for the new ACL rules.
Once the negation command is executed, the second and the third commands proceed to
redefine ACL 101. The final command applies the ACL to interface int12.
216 Internet Appliance User Reference Manual