remove one line of access-list

[pslavkovsky]

Hi,

I have one easy question.

I have in PIX configuration 25 lines of access-list.

I need remove one line of access-list.

Do I lose whole access list when I remove one line like on router access list ?

Thanks

Peter

[jmia]

Peter

I presume you are talking about editing ACLs on the pix firewall and not cisco router?

If you want to edit the ACL on your pix then do the following,

1. Log on to the pix using either HyperTerminal/telnet or console port.

2. Copy the required ACLs (inside or outside) make sure to copy the access-group ACL that corresponds to your required ACL (access-group in interface inside or access-group in interface outside).

3. Open up text editor (notepad) on your local PC/Notebook and paste the copied ACLs, type no access-list as the first line on your copied ACLs i.e. on top of your copied ACLs.

4. Now edit your ACLs as required, i.e. takeout the ACL that you don't need.

5. Back on the pix in configuration mode paste back the edited ACLs.

6. Issue command write mem on the pix to save and also issue command clear xlate.

If you have PDM running on the pix then you can delete the required ACL without having to use the above steps.

Hope this helps

Jay

[jonathanstevens]

That's exactly how I would do it too.

Incidentally, I tend to keep copies of the latest scripts for such changes, which makes corrections, optimisations and changes very much easier.

[pslavkovsky]

OK,

but when I paste edited text, the first line is "no access-list "

and second line is "access-list "

So I first remove access list and then I put new ACL.

And time between this steps?

I do not lose created connections? I have about 18000 connections created.

Peter

[jmia]

Peter

On your notepad just place no access-list and then your copied ACLs i.e.

no access-list inside

access-list inside permit tcp host any eq www

"

"

"

access-group inside in interface inside

Now paste back on to the pix in config mode and then save with write mem and aslo issue clear xlate, and you should be done! You need to clear translations so that your modified ACLs start to take effect.

Jay

[pslavkovsky]

Hi,

I got answer from one man of Cisco Systems that is possible to remove 1 line by just putting "no" infront of whole line.

Peter

[khotaling]

yes you can remove 1 line by typing no in front of your acl command.