Multiple ACL entries in ASA with same Line number

[Harmeet Singh]

Hi All,

Is it possible to add multiple ACL entries is ASA with same line number?

When we use NAME instead of line number in conf command then how the asa decide to assign a number to that entry? Can the firewall assign same number to multiple entries?

My ASA 5550 configuration is:

ciscoasa/admin# sh running-config | in ACL-OUTSIDE

access-list ACL-OUTSIDE extended permit ip host X.X.X.X any
access-list ACL-OUTSIDE extended permit ip host Y.Y.Y.Y any
access-list ACL-OUTSIDE extended permit ip host Z.Z.Z.Z any

ciscoasa/admin# sh access-list ACL-OUTSIDE

access-list ACL-OUTSIDE; 3 elements
access-list ACL-OUTSIDE line 9 extended permit ip host X.X.X.X any (hitcnt=25924815) 0x75077dcb
access-list ACL-OUTSIDE line 9 extended permit ip host Y.Y.Y.Y any (hitcnt=14691856) 0x75077dcb
access-list ACL-OUTSIDE line 9 extended permit ip host Z.Z.Z.Z any (hitcnt=58014597) 0x75077dcb

I just picked three entries for example only out of 3149 entries and hide their IPs.

Thanks.

[Karsten Iwen · Accepted solution]

You can not configure multiple ACEs to have the same line number. The configured lines are just numbered 1..x. If you add a new ACE with a line number, this new ACE is added at the given position and all ACEs are shifted down one position.

But each configured ACE can result in multiple lines that are effectively used when the ACE uses objects or object-groups. That is what you see in your example.

[Harmeet Singh]

Thanks Karsten Iwen.

Multiple ACE are with same line number because these are from same object group.