Creating or editing an ACL offline

The section titled Editing an existing ACL describes how to use the CLI to edit an ACL, and is most applicable in cases where the ACL is short or there is only a minor editing task to perform. The offline method provides an alternative to using the CLI for creating or extensively editing a large ACL. This section describes how to:

Procedure
  1. Move an existing ACL to a TFTP server.
  2. Use a text (.txt) file format to create a new ACL or edit an existing ACL offline.
  3. Use TFTP to load an offline ACL into the switch running-config.

For longer ACLs that may be difficult or time-consuming to accurately create or edit in the CLI, you can use the offline method described in this section.

NOTE:

The copy commands that use either tftp or xmodem, also include an option to use usb as a source or destination device for file transfers. So although the following example highlights TFTP, the xmodem or usb can also be used to transfer ACLs to and from the switch.

  • Begin by doing one of the following:
    • To edit one or more existing ACLs, use copy command-output tftp to copy the current version of the ACL configuration to a file in your TFTP server. For example, to copy the ACL configuration to a file named acl-02.txt in the TFTP directory on a server at 10.28.227.2:
      switch# copy command-output 'show access-list config' tftp 10.28.227.2 acl02.txt pc
      
    • To create a new ACL, open a text (.txt) file in the appropriate directory on a TFTP server accessible to the switch.

  • Use a text editor to create or edit the ACLs in the *.txt ASCII file format.

  • If you are replacing an ACL on the switch with a new ACL that uses the same number or name syntax, begin the command file with a no ip access-list command to remove the earlier version of the ACL from the switch running-config file. Otherwise, the switch appends the new ACEs in the ACL you download to the existing ACL.

  • For example, if you planned to use the copy command to replace ACL "List-120", place this command at the beginning of the edited file:
    no ip access-list extended List-120
    Figure 108: An offline ACL file designed to replace an existing ACL
  • Use copy tftp command-file to download the file as a list of commands to the switch.

Example

Suppose that you want to create an extended ACL for an RACL application to fulfill the following requirements (Assume a subnet mask of 255.255.255.0 and a TFTP server at 10.10.10.1.):

  • ID: "LIST-20-IN"

  • Deny Telnet access to a server at 10.10.10.100 on VLAN 10 from these three addresses on VLAN 20 with ACL logging:
    • 10.10.20.17

    • 10.10.20.23

    • 10.10.20.40

  • Allow any access to the server from all other addresses on VLAN 20:

  • Permit Internet access to these two addresses on VLAN 20, but deny access to all other addresses on VLAN 20 (without ACL logging).
    • 10.10.20.98

    • 10.10.20.21

  • Deny all other IPv4 traffic from VLAN 20 to VLAN 10.

  • Deny all IPv4 traffic from VLAN 30 (10.10.30.0) to the server at 10.10.10.100 on VLAN 10 (without ACL logging), but allow any other IPv4 traffic from VLAN 30 to VLAN 10.

  • Deny all other inbound IPv4 traffic to VLAN 20. (Hint: The Implicit Deny can achieve this objective.)

  • Create a .txt file with the content shown in the following figure.
    Figure 109: A .txt file designed for creating an ACL
  • After copying the preceding .txt file to a TFTP server the switch can access, execute the following command:

  • copy tftp command-file 10.10.10.1 LIST-20-IN.txt pc

  • In this example, the CLI shows the following output to indicate that the ACL was successfully downloaded to the switch:
    NOTE:

    If a transport error occurs, the switch does not execute the command and the ACL is not configured.

    Figure 110: Using copy tftp command-file to configure an ACL in the switch
  • In this example, the command to assign the ACL to a VLAN was included in the .txt command file. If this is not done in your applications, the next step is to manually assign the new ACL to the intended VLAN.

  • vlan <vid> ip access-group <identifier> in

  • Use the show run or show access-list config command to inspect the switch configuration to ensure that the ACL was properly downloaded.
    Figure 111: Verifying the .txt file download to the switch
  • If the configuration appears satisfactory, save it to the startup-config file:
    switch(config)# write memory