Nortel Networks 2300 manual Placing One ACE before Another

Configuring and Managing Security ACLs 371

Placing One ACE before Another

You can use the before editbuffer-indexportion of the set security acl command to place a new ACE before an existing ACE. For example, suppose you want to deny some traffic from IP address 192.168.254.12 in acl-111. Follow these steps:

1To display all committed security ACLs, type the following command:

23x0# show security acl info all

ACL information for all

set security acl ip acl-111 (hits #4 0)

----------------------------------------------------

1.permit IP source IP 192.168.253.11 0.0.0.0 destination IP

any

set security acl ip acl-2 (hits #1 0)

----------------------------------------------------

1.permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0 destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0 enable-hits

2To add the deny ACE to acl-111and place it first, type the following commands:

23x0# set security acl ip acl-111 deny 192.168.254.12 0.0.0.255 before 1

23x0# commit security acl acl-111 success: change accepted.

3To view the results, type the following command:

23x0# show security acl info all

ACL information for all

set security acl ip acl-111 (hits #4 0)

----------------------------------------------------

1.deny IP source IP 192.168.254.12 0.0.0.255 destination IP

any

2.permit IP source IP 192.168.253.11 0.0.0.0 destination IP

any

set security acl ip acl-2 (hits #1 0)

----------------------------------------------------

1.permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0 destination IP 192.168.1.15 0.0.0.0 precedence 0 tos 0 enable-hits

Nortel WLAN Security Switch 2300 Series Configuration Guide