Create and Use Dynamic Parameter File

Create and Use Dynamic Parameter File

Basic, advanced, and Ethernet frame header ACLs support ACL rules with a dynamic parameter specified, which can be:

• Source IP address
• Destination IP address
• Source MAC address
• Destination MAC address.

With the dynamic parameter, an ACL rule is flexible and varies with the IP address of the target device. The dynamic parameter names and values are stored in a special CSV file together with the mapped device IP addresses.

Parameters

1. Device_IP: IP address of the device. The IP address must be the first parameter of the dynamic parameter file in a valid format.
2. Custom parameters: Located next to the Device_IP parameter in the first line of the dynamic parameter file. The name of each custom parameter is a string of 1 to 32 characters that comprises letters and numbers. The value of each parameter must be in the IP address/mask or MAC address/MAC mask(same with MAC address format) format. For example : 127.0.0.1/255.0.0.0, 127.0.0.0/32, and 0014-2AD9-D5F7/FFFF-FFFF-FFFF. You must configure at least one customized parameter in the file.
3. Configuration Example:
   • Deploy basic ACL 2000 to devices A (192.168.0.1), B (192.168.0.2), and C (192.168.0.3) so that:
     • Device A cannot be pinged from source IP address 10.10.10.1/255.0.0.0.
     • Device B cannot be pinged from source IP address 10.10.10.2/255.0.0.0.
     • Device C cannot be pinged from source IP address 10.10.10.3/255.0.0.0.
   • Configuration Procedures:

     Add ACL Resource:

     a. Click the Service tab, click ACL Resource in the navigation tree, and then click Add-Common ACL Resource to enter the Add ACL Resource page.
     b. Select Basic for ACL Type, and set both the ACL Identifier and ACL Resource Name fields to 2000. Click OK.
     c. On the ACL Resource page, click the ACL identifier 2000 to enter the Rule Set List page.
     d. Click Add. Configure the basic information for the rule set, and then click Next.
     e. Click Add to configure an ACL rule. Select Deny for Action and Dynamic Parameter for Source Address, and then enter source_addr (custom parameter in the dynamic parameter file) in the box next to Dynamic Parameter. Click OK.
     f. Click Finish.

     Add Dynamic Parameter File:

     a. Add the dynamic parameter configuration file aclDynamicPara.csv to the directory {imc.home}\iMC\client\ conf\acl\dynamicParaFile.
     b. File content:

     Device_IP	source_addr
     192.168.0.1	10.10.10.1/255.0.0.0
     192.168.0.2	10.10.10.2/255.0.0.0
     192.168.0.3	10.10.10.3/255.0.0.0

     Deploy ACL:

     a. Deploy ACL 2000 to devices A, B, and C.

Precautions

• The dynamic parameter file name must be aclDynamicPara.csv.
• The dynamic parameter file must be saved in the directory {imc.home}\iMC\client\conf\acl\dynamicParaFile.
• The file must be encoded in ANSI.
• A dynamic parameter is displayed in the form of <%parameter name%>.