Brocade Multi-Service IronWare Security Configuration Guide (Supporting R05.6.00) - Manual (Page 140)

122 Multi-Service IronWare Security Configuration Guide
53-1003035-02
Modifying ACLs
3
Modify an ACL by configuring an ACL list on a file server.
1. Use a text editor to create a new text file. When you name the file, use 8.3 format (up to eight
characters in the name and up to three characters in the extension).
NOTE
Make sure the Brocade device has network access to the TFTP server.
2. Optionally, clear the ACL entries from the ACLs you are changing by placing commands such as
the following at the top of the file.
Brocade(config)#no access-list 1
Brocade(config)#no access-list 101
When you load the ACL list into the Brocade device, the software adds the ACL entries in the
file after any entries that already exist in the same ACLs. Thus, if you intend to entirely replace
an ACL, you must use the no access-list num command to clear the entries from the ACL before
the new ones are added.
3. Place the commands to create the ACL entries into the file. The order of the separate ACLs
does not matter, but the order of the entries within each ACL is important. The software applies
the entries in an ACL in the order they are listed within the ACL. Here is an example of some
ACL entries.
Brocade(config)#access-list 1 deny host 10.157.22.26
Brocade(config)#access-list 1 deny 10.157.22.0 0.0.0.255
Brocade(config)#access-list 1 permit any
Brocade(config)#access-list 101 deny tcp any any eq http
The software will apply the entries in ACL 1 in the order shown and stop at the first match.
Thus, if a packet is denied by one of the first three entries, the packet will not be permitted by
the fourth entry, even if the packet matches the comparison values in this entry.
4. Enter the command “end” on a separate line at the end of the file. This command indicates to
the software that the entire ACL list has been read from the file.
5. Save the text file.
6. On the Brocade device, enter the following command at the Privileged EXEC level of the CLI:
copy tftp running-config tftp-ip-addr filename
NOTE
This command will be unsuccessful if you place any commands other than access-list and end (at
the end only) in the file. These are the only commands that are valid in a file you load using the copy
tftp running-config… command.
7. To save the changes to the Brocade device’s startup-config file, enter the following command
at the Privileged EXEC level of the CLI:
write memory
NOTE
Do not place other commands in the file. The Brocade device reads only the ACL information in the
file and ignores other commands, including ip access-group commands. To assign ACLs to
interfaces, use the CLI.