topic You can not configure in Network Security

Multiple ACL entries in ASA with same Line number

Harmeet Singh — Tue, 12 Mar 2019 08:58:59 GMT

Hi All,

Is it possible to add multiple ACL entries is ASA with same line number?

When we use NAME instead of line number in conf command then how the asa decide to assign a number to that entry? Can the firewall assign same number to multiple entries?

My ASA 5550 configuration is:

ciscoasa/admin# sh running-config | in ACL-OUTSIDE

access-list ACL-OUTSIDE extended permit ip host X.X.X.X any
access-list ACL-OUTSIDE extended permit ip host Y.Y.Y.Y any
access-list ACL-OUTSIDE extended permit ip host Z.Z.Z.Z any

ciscoasa/admin# sh access-list ACL-OUTSIDE

access-list ACL-OUTSIDE; 3 elements
access-list ACL-OUTSIDE line 9 extended permit ip host X.X.X.X any (hitcnt=25924815) 0x75077dcb
access-list ACL-OUTSIDE line 9 extended permit ip host Y.Y.Y.Y any (hitcnt=14691856) 0x75077dcb
access-list ACL-OUTSIDE line 9 extended permit ip host Z.Z.Z.Z any (hitcnt=58014597) 0x75077dcb

I just picked three entries for example only out of 3149 entries and hide their IPs.

Thanks.

You can not configure

Karsten Iwen — Sun, 26 Feb 2017 10:59:38 GMT

You can not configure multiple ACEs to have the same line number. The configured lines are just numbered 1..x. If you add a new ACE with a line number, this new ACE is added at the given position and all ACEs are shifted down one position.

But each configured ACE can result in multiple lines that are effectively used when the ACE uses objects or object-groups. That is what you see in your example.

Thanks Karsten Iwen.

Harmeet Singh — Sat, 18 Mar 2017 09:32:24 GMT

Thanks Karsten Iwen.

Multiple ACE are with same line number because these are from same object group.