Modifying a Security ACL 3952 To add another ACE to the end of acl-violet, type the followingcommand:WX1200# set security acl ip acl-violet permit192.168.123.11 0.0.0.255 hits3 To commit the updated security ACL acl-violet, type the followingcommand:WX1200# commit security acl acl-violetsuccess: change accepted.4 To display the updated acl-violet, type the following command:WX1200# display security acl infoACL information for allset security acl ip acl-violet (hits #2 0)----------------------------------------------------1. permit IP source IP 192.168.253.1 0.0.0.255 destination IP any enable-hits2. permit IP source IP 192.168.123.11 0.0.0.255 destination IP any enable-hitsPlacing One ACEbefore AnotherYou can use the before editbuffer-index portion of the set security aclcommand to place a new ACE before an existing ACE. For example,suppose you want to deny some traffic from IP address 192.168.254.12in acl-111. Follow these steps:1 To display all committed security ACLs, type the following command:WX1200# display security acl infoACL information for allset security acl ip acl-111 (hits #4 0)----------------------------------------------------1. permit IP source IP 192.168.253.11 0.0.0.0 destination IP anyset security acl ip acl-2 (hits #1 0)----------------------------------------------------1. permit L4 Protocol 115 source IP 192.168.1.11 0.0.0.0 destination IP192.168.1.15 0.0.0.0 precedence 0 tos 0 enable-hits2 To add the deny ACE to acl-111 and place it first, type the followingcommands:WX1200# set security acl ip acl-111 deny 192.168.254.120.0.0.255 before 1WX1200# commit security acl acl-111success: change accepted.
