There is a configurable process for applications to insert an ACL into a zone according to the priority of the application within that zone. Applications can occupy multiple zones. For example, you can add the Cli application to the DOS zone, and assign it a higher priority than the Dos application. The DOS zone then has two applications, Cli and Dos application, and within the DOS zone, an ACL created by the Cli has a higher priority than an ACL inserted by the Dos application.
Another way to configure ACL priority is by creating new zones. For example, you might create a zone called MY_HIGH_ZONE, and assign that zone a priority below the DOS zone and above the System zone. You can add applications to that zone and assign their priority.
The example below shows the ACL zone priority that would result from adding the MacInMac and Cli applications to MY_HIGH_ZONE:
Applications can insert an ACL into any of the zones to which the application belongs.
The priority attributes first (highest priority) and last (lowest priority) can be applied to an ACL to establish its position within a zone.
Relative priority sets the ACL priority relative to another ACL already installed by the application in the same zone.
Priority numbers allow an application to specify the priority of an ACL within a zone. The priority numbers are unsigned integers from 0 to 7; a lower number represents a higher priority. This means that if an application adds an ACL at priority 5 and later adds another ACL at priority 3, the second ACL has higher priority.
If an application assigns the same priority number to two ACLs, the ACL added most recently has the higher priority. It is inserted in the priority map immediately ahead of the older ACL that has the same priority number. This effectively allows the application to create sub-zones within a zone. The attributes first and last can be used in combination with priority numbers to prioritize the ACLs within a sub-zone. For example, an ACL could be configured with the first attribute, along with the same priority number as other ACLs in the same zone, effectively assigning that ACL the highest priority within a sub-zone.
The show configuration command shows the current configuration of the entire switch in the form of CLI commands which can later be played back to configure the switch.
The show configuration acl command shows the current configuration of the ACL manager.
The new application keyword allows you to specify the application to which the ACL will be bound. Typically, applications create and insert ACLs on the switch; however the administrator can install ACLs "on behalf" of an application by specifying the application keyword. (This keyword is also used with the show config acl command to enable CLI playback). If no application is specified, the default application is CLI.
This means you have the ability to create, delete, and configure ACLs for any application.
create access-list zone name zone-prioritynumber
configure access-list zone name zone-priority number
configure access-list zone name {add} applicationappl-name application_priority number
An application must occupy at least one zone.
configure access-list zone name move-applicationappl-name to-zonenumber application-prioritynumber
All applications can be configured to go into any and all zones.
A change in the zone list results in a change in the order of dynamic ACLs that have been applied per interface. The changes in hardware are achieved by uninstalling and then reinstalling the dynamic ACLs in the new positions. There is a possibility, due to hardware constraints, that some ACLs will not be reinstalled. These occurrences are logged.
configure access-list zone name delete application appl-name
When you delete an application from a zone, any ACLs that have been inserted into that zone for the deleted application are moved to the next higher zone in which the application appears.
delete access-list zone name
You must remove all applications from a zone before you can delete the zone. You cannot delete the default zones.