Comments and Descriptions in ACL Policy Files

In ACL (Access Control List) policy files, there are two types of textual additions that have no effect on the ACL actions: comments and descriptions. A comment is ignored by the policy manager and resides only in the policy file. Comments are not saved in the switch configuration and are not displayed by the show policy command. A description is saved in the policy manager and is displayed when the ACL is displayed.

You can display the ACL using the following two commands:
show policy {policy-name | detail}

show access-list {any | ports port_list | vlan vlan_name} {ingress | egress}
For example, the following policy, saved in the file denyping.pol, contains both a comment and a description:
```
# this line is a comment
@description "This line is a description for the denyping.pol"
entry ping_deny_echo-request {
	if {
		protocol icmp;
		icmp-type echo-request;
	} then {
		deny;
		count pingcount_deny;
	}
}
```
Note that the description begins with the tag @description and is a text string enclosed in quotes.
You can apply the policy to port 1 using the following command:
```
configure access-list denyping port 1
```

and display the policy using the following command:

show policy denyping

The output of this command is similar to the following:

Policies at Policy Server:
Policy: denyping
@description This line is a description for the denyping.pol
entry ping_deny_echo-request {
if match all {
protocol icmp ;
icmp-type echo-request ;
}
Then {
deny  ;
count pingcount_deny ;
}
}
Number of clients bound to policy: 1
Client: acl bound once

Published March 2020prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback