topic Re: ASA 5500 Access List removal in Network Security

ASA 5500 Access List removal

Dale Sanderson — Mon, 11 Mar 2019 16:50:38 GMT

I do apologise for reposting; however I am still having a few issues.

After removing a capture from the firewall, I am now trying to remove the access-list associated.

However, the below output shows that the access-list is still infact present on the firewall

host# sh access-list SL-CAP
access-list SL-CAP; 0 elements
host# conf t
host(config)# clear configure access-list SL-CAP
host(config)# wr
Building configuration...

[OK]
host(config)# end
host# sh run | inc SL-CAP

#no output#

host# sh access-list SL-CAP
access-list SL-CAP; 0 elements

Although it is not really a big problem; it would be nice to resolve and see what is causing this strange behaviour.

Regards

Re: ASA 5500 Access List removal

mohsin.khan — Mon, 21 Dec 2009 16:21:06 GMT

just wondering why don't you use the "no " prefix for removing ACL??

Re: ASA 5500 Access List removal

Dale Sanderson — Mon, 21 Dec 2009 16:31:19 GMT

I believe that using "no" will only remove particular ACL entries as opposed to the ACL itself; forgive me if I am wrong on that..

Re: ASA 5500 Access List removal

mohsin.khan — Mon, 21 Dec 2009 17:08:10 GMT

No, infact you are right, thanks for making me rush to the config guide , but at times there are few commands that need system restart to flush out from the NVRAM. Not sure about this particular command. I haven't used the clear configure command, rather i usually copy the config to a notepad and add a no statement to the ACL (to all if i need to delete the complete ACL).

Re: ASA 5500 Access List removal

Dale Sanderson — Mon, 21 Dec 2009 17:11:22 GMT

Ok, thankyou for the advice!

I will leave this thread open for a little to see if further networking guru's can advise & at a last resort I will use your method.

Thanks again!

Re: ASA 5500 Access List removal

Kureli Sankar — Mon, 21 Dec 2009 17:13:41 GMT

If the following doesn't work

conf t

clear config access-list SL-CAP

Then add a few lines of dummy acl to the access-list like

access-l SL-CAP permit icmp any any

access-l SL-CAP deny ip any any

Make sure sh access-l SL-CAP | i elements

shows 2 and then try the same thing again.

clear config access-l SL-CAP

-KS

Re: ASA 5500 Access List removal

Dale Sanderson — Mon, 21 Dec 2009 17:16:07 GMT

Ok, will give that a go

Cheers

Re: ASA 5500 Access List removal

Dale Sanderson — Mon, 21 Dec 2009 17:21:03 GMT

You my friend, are a star!

That worked perfectly - I take it that an 'empty' access list cannot be removed and will bare this in mind for future and ensure the list is populated.

Thanks again!