HP StorageWorks 8/80 HP StorageWorks Fabric OS 6.2 administrator guide (5697-0 - Page 141

-rule rule number -sip source IP -dp destination port -proto protocol -act Specifies a valid rule number between 1 and the current maximum rule number plus 1. Specifies the source IP address. For IPv4 filter type, the address must be a 32-bit address in dot decimal notation, or a CIDR block IPv4 prefix. For IPv6 filter type, the address must be a 128-bit IPv6 address in any format specified by RFC, or a CIDR block IPv6 prefix. Specifies the destination port number, or a range of port numbers, or a service name. Specifies the protocol type, either TCP or UDP. Specifies the permit or deny action associated with this rule. Deleting a rule to an IP Filter policy Deleting a rule in the specified IP Filter policy causes the rules following the deleted rule to shift up in rule order. The change to the specified IP Filter policy is not saved to persistent configuration until a save or activate subcommand is run. 1. Log in to the switch using an account assigned to the admin role. 2. Enter the following command: ipfilter --delrule -rule Aborting a transaction associated with IP Filter A transaction is associated with a command line or manageability session. It is opened implicitly when the --create, --addrule, --delrule, --clone, and --delete subcommands are run. The --transabort, --save, or --activate subcommands explicitly end the transaction owned by the current command line or manageability session. If a transaction is not ended, other command line or manageability sessions are blocked on the subcommands that would open a new transaction. 1. Log in to the switch using an account assigned to the admin role. 2. Enter the following command: ipfilter --transabort IP Filter policy distributions The IP Filter policy is manually distributed using the distribute -p "IPFILTER" command. The distribution includes both active and defined IP Filter policies. All policies are combined as a single entity to be distributed and cannot be selectively distributed. However, you may choose the time at which to implement the policy for optimization purposes. If a distribution includes an active IP Filter policy, the receiving switches activate the same IP Filter policy automatically. When a switch receives IP Filter policies, all uncommitted changes left in its local transaction buffer are lost, and the transaction is aborted. Switches with Fabric OS 5.3.0 or later have the ability to accept or deny IP Filter policy distribution, through the commands fddCfg --localaccept or fddCfg --localreject. However, automatic distribution of IP Filter policy through Fabric Wide Consistent Policy is not supported in Fabric OS 6.2.0. See "Policy database distribution" on page 139 for more information on distributing the IP Filter policy. IP Filter policy restrictions In a mixed fabric with Fabric OS 5.3.0 or later and pre-5.3.0 switches, IP Filter policies cannot be distributed from a Fabric OS 6.2.0 switch to a pre-5.3.0 switch. This means that the sending switch will fail a distribute -p "IPFILTER" operation, if the specified receiving domain list contains switches with Fabric OS 5.2.0 and earlier. When the asterisk (*) is used as the receiving domain, the sending switch distributes the IP Filter policies only to switches with Fabric OS 5.3.0 or later. Policy database distribution Fabric OS lets you manage and enforce the ACL policy database on either a per-switch or fabric-wide basis. The local switch distribution setting and the fabric-wide consistency policy affect the switch ACL policy database and related distribution behavior. Fabric OS 6.2 administrator guide 139