topic Re: pix: problem with access-list line numbers in Network Security

pix: problem with access-list line numbers

joerg.hartmann — Fri, 21 Feb 2020 07:46:20 GMT

Hello,

i have a PIX 515e with Software Version 6.3(1).

Ok - i am new to the pix but i can read manuals ...

The pix has a runnig-config which i like to change.

But i have a problem with the line numbers of the access-lists.

As a test i tried to insert a remark at the access-list of the inside interface like this:

access-list inbound1 line 12 remark just a test

No complains - but it ended up at line 16.

At least "show access-list inbound1" shows this to me.

So i tried to delete this remark with the same command i createt it

no access-list inbound1 line 12 remark just a test

I got no error message but the remark survived this.

Now i am a little bit confused about the line numbers.

Could someone pls explain what happend or what i did wrong ?

If the line numbers not function like i expect it to work, can i accidently delete an othe line ?

regards

Joerg

Re: pix: problem with access-list line numbers

ehirsel — Wed, 01 Dec 2004 19:47:38 GMT

There may be a bug in the 6.3.1 code. I never used it, I went to 6.3.2, from 6.2.

Try this test using another acl and let me know how it proceeds.

1. Run these commands

access-list test01 permit tcp any any

access-list test01 permit udp any any

access-list test03 permit gre any any

access-list test03 line 3 remark This is for GRE

2. Run the show access-list test03 command and post the results here.

3. Run this command:

no access-list test02 line 2 permit udp any any

4. Rerun the show access-list tes03 command and post the results here.

Re: pix: problem with access-list line numbers

joerg.hartmann — Thu, 02 Dec 2004 09:58:33 GMT

Thanks for your answer - but after all i am more confused than before.

Ok - i tried your test commands.

But, this worked like it should. No problems with the line numbers.

After that i made a new test with the "real" existing access-lists and had still no luck.

show access-list inside_access_in

....

access-list inside_access_in line 12 remark

access-list inside_access_in line 13 remark rule for administrative group

access-list inside_access_in line 14 remark

access-list inside_access_in line 15 remark

access-list inside_access_in line 16 remark nur ein test

access-list inside_access_in line 17 permit tcp 172.18.3.0 255.255.255.0 host gimli object-group sap

....

access-list inside_access_in line 15 remark just the next test

show access-list inside_access_in

....

access-list inside_access_in line 12 remark

access-list inside_access_in line 13 remark rule for administrative group

access-list inside_access_in line 14 remark

access-list inside_access_in line 15 remark

access-list inside_access_in line 16 remark nur ein test

access-list inside_access_in line 17 remark just the next test

access-list inside_access_in line 18 permit tcp 172.18.3.0 255.255.255.0 host gimli object-group sap

....

And now i am realy confused :{

The remark SHOULD go to line 15, but it ended up on line 17.

Even deleting the remark from line 17 does not work.

Maybe the TurboACL feature causes this problem ?

Dont now what to do now.

regards

Joerg