Create/Modify ACLs from within TMSH

This, I believe, is one of those commands that doesn't allow additive editing. So because it looked like an interesting scripting challenge, here's a Bash script you can use to add acl entries to an existing acl:

!/bin/bash

if [ "$1" == "" ] || [ "$2" == "" ]
then
    echo "Syntax error:   name>  "
    exit
fi

acllist=`tmsh list apm acl test-acl one-line | sed -n "s/.*{ { \([^']*\) } }.*/\1/p"`

IFS={ read -a array <<< "$acllist"

acl="{"
for i in "${array[@]}"
do
    acltmp="{ `echo $i |sed "s/}//"` }"
    acl="$acl $acltmp"
done
acl="$acl { $2 } }"

tmsh modify apm acl $1 entries $acl

This is what your command line would look like:

./addacl.sh test-acl "action reject dst-subnet 0.0.0.0/0 src-subnet 10.60.0.0/24"

The first param is the acl name, and the second is the acl entry string.