ASA Firepower - ACL line manupulation

[oscardenizjensen]

Hej
I was wondering if there is a way to move a line in ACL to another line without removing it first? For example move line 3 to line 2 without deleting it first?

fw01-tgl-cph(config)# show access-list TEST
access-list TEST; 2 elements; name hash: 0xd37fdb2b
access-list TEST line 1 remark TEST
access-list TEST line 2 extended deny ip any any (hitcnt=0) 0xa887db65
access-list TEST line 3 extended permit ip host 172.16.1.1 any (hitcnt=0) 0x2546ce33

[sadks · Accepted solution]

Hi,

You can't move an existing ACE to another line as you will get the following error:

ASA(config)# access-list TEST line 2 permit ip host 172.16.1.1 any
WARNING: <TEST> found duplicate element
access-list TEST line 2 permit ip host 172.16.1.1 any

So you will have to delete the ACE and then add to the line you want:

ASA(config)# no access-list TEST line 4 extended permit ip host 172.16.1.1 any
ASA(config)# access-list TEST line 1 permit ip host 172.16.1.1 any

ASA# sh access-list
access-list TEST; 3 elements; name hash: 0xd37fdb2b
access-list TEST line 1 extended permit ip host 172.16.1.1 any (hitcnt=0) 0x2546ce33
access-list TEST line 2 remark TEST
access-list TEST line 3 extended deny ip any any (hitcnt=0) 0xa887db65

Hope the above helps.

[oscardenizjensen]

Thanks. That was the error I was getting, and did it the way you suggested. I would just prefer if there was a way to move the lines without deleting.

[sadks]

Hi,

I completely understand but unfortunately, the reason for this is that we don't want duplicate entries on the ACL which can cause an issue in the future. You can however insert a completely new entry in between or after deleting the same entry.