https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334819#M4552 直接no掉第二条，然后通过line number的方式添加到第一行即可<BR />access-list dmz-acl <FONT color="Red">line 1</FONT> extended deny ip any host 162.0.215.197<BR />show access-list dmz-acl 查看添加后结果<BR /> Mon, 08 Mar 2021 13:35:40 GMT ilay 2021-03-08T13:35:40Z https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334817#M4550 access-list dmz-acl extended permit ip any object-group fhw-sie <BR /><FONT color="#ff0000">access-list dmz-acl extended deny ip any host 162.0.215.197 </FONT><BR />access-list dmz-acl extended permit ip object fhw-Proxy any <BR />access-list dmz-acl extended permit ip object fhw-hoping any <BR />想把第二条移动到第一条的位置 先执行 deny<BR /> Sat, 06 Mar 2021 03:07:59 GMT https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334817#M4550 linwei22403 2021-03-06T03:07:59Z https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334818#M4551 把整个ACCELSS-list 删除了，重新写一下呢 Mon, 08 Mar 2021 09:12:36 GMT https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334818#M4551 wyc_chao 2021-03-08T09:12:36Z https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334819#M4552 直接no掉第二条，然后通过line number的方式添加到第一行即可<BR />access-list dmz-acl <FONT color="Red">line 1</FONT> extended deny ip any host 162.0.215.197<BR />show access-list dmz-acl 查看添加后结果<BR /> Mon, 08 Mar 2021 13:35:40 GMT https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334819#M4552 ilay 2021-03-08T13:35:40Z https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334820#M4553 <BLOCKQUOTE><FONT size="2"><A href="https://community.cisco.com/forum.php?mod=redirect&amp;goto=findpost&amp;pid=1054037&amp;ptid=992100" target="_blank"><FONT color="#999999">gengchunlin 发表于 2021-3-8 21:35</FONT></A></FONT><BR />直接no掉第二条，然后通过line number的方式添加到第一行即可<BR />access-list dmz-acl line 1 extended deny ...</BLOCKQUOTE><BR />感谢验证可行，学习到了 Tue, 09 Mar 2021 05:42:35 GMT https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334820#M4553 linwei22403 2021-03-09T05:42:35Z https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334821#M4554 show run 是不显示ACL编号的，但实际这个编号在show acl 时会显示，在命令上只要加上编号，就可以插入了；<BR />举例如下：<BR />ciscoasa(config)# access-list demo permit host 192.168.1.1 <BR />ciscoasa(config)# access-list demo permit host 192.168.1.2 <BR />ciscoasa(config)# access-list demo permit host 192.168.1.3<BR />ciscoasa# show access-list demo<BR />access-list demo; 3 elements; name hash: 0x61985251<BR />access-list demo line 1 standard permit host 192.168.1.1 (hitcnt=0) 0xb94e4b8b <BR />access-list demo line 2 standard permit host 192.168.1.2 (hitcnt=0) 0x9176794b <BR />access-list demo line 3 standard permit host 192.168.1.3 (hitcnt=0) 0x4448b463 <BR />ciscoasa(config)# access-list demo line ?<BR />configure mode commands/options:<BR /> &lt;1-2147483647&gt; Line-number<BR />ciscoasa(config)# access-list demo line 2 deny host 192.168.1.4<BR />ciscoasa(config)# show access-list demo<BR />access-list demo; 4 elements; name hash: 0x61985251<BR />access-list demo line 1 standard permit host 192.168.1.1 (hitcnt=0) 0xb94e4b8b <BR />access-list demo line 2 standard deny host 192.168.1.4 (hitcnt=0) 0x2cdeb408 <BR />access-list demo line 3 standard permit host 192.168.1.2 (hitcnt=0) 0x9176794b <BR />access-list demo line 4 standard permit host 192.168.1.3 (hitcnt=0) 0x4448b463 <BR />ciscoasa(config)# show run access-list <BR />access-list demo standard permit host 192.168.1.1 <BR />access-list demo standard deny host 192.168.1.4 <BR />access-list demo standard permit host 192.168.1.2 <BR />access-list demo standard permit host 192.168.1.3 Sat, 13 Mar 2021 09:22:15 GMT https://community.cisco.com/t5/%E5%AE%89%E5%85%A8%E8%AE%A8%E8%AE%BA%E5%8C%BA/%E6%80%9D%E7%A7%91asa-%E5%A6%82%E4%BD%95%E5%B0%86%E6%96%B0%E7%9A%84access-list-%E6%94%BE%E7%BD%AE%E5%9C%A8%E6%9C%80%E5%89%8D%E9%9D%A2/m-p/4334821#M4554 YilinChen 2021-03-13T09:22:15Z