Nortel 2350 用户指南

428 Configuring and managing security ACLs

NN47250-500 (320657-F Version 02.01)

Placing one ACE before another

You can use the before editbuffer-index portion of the set security acl command to place a new ACE before an existing
ACE. For example, suppose you want to deny some traffic from IP address 192.168.254.12 in acl-111. Follow these
steps:

To display all committed security ACLs, type the following command:

WSS# show security acl info
ACL information for all

set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any

set security acl ip acl-2 (hits #1 0)
----------------------------------------------------
1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0
destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0
enable-hits

To add the deny ACE to acl-111 and place it first, type the following commands:

WSS# set security acl ip acl-111 deny 192.168.254.12 0.0.0.255 before 1

WSS# commit security acl acl-111
success: change accepted.

To view the results, type the following command:

WSS# show security acl info
ACL information for all

set security acl ip acl-111 (hits #4 0)
----------------------------------------------------
1. deny IP source IP 192.168.254.12 0.0.0.255 destination IP
any
2. permit IP source IP 192.168.253.11 0.0.0.0 destination IP
any