03-31-2005 11:17 AM - edited 03-03-2019 09:10 AM
Does anybody have an explaination or link that explains why ACL line entries will automatically get reordered? I'm trying to put remarks in the ACL, however the IOS seems to reorder things so the remarks aren't near their respective entry.
I'm noticing this across all IOS/CatIOS platforms including 2950s, 262Xs, 4507s, 6509s, etc.
Thanks,
Steve
03-31-2005 11:27 AM
The only time that I have noticed ACL entries getting reordered is in the case of a standard access list where any host specific references are put at the top of the list before any more general entries (which does make sense). Other than that I have not noticed the same symptoms that you are describing.
HTH
Rick
03-31-2005 11:35 AM
Hi Rick,
Yes they are standard ACLs (for VTY access), I've built them with host specific at the top, with a remark above each one to identify which team member the ip belongs to. At the bottom I've put the network or more general entries. It does keep them seperated (hosts at top, networks at the bottom), but it does reorder the hosts.
Thanks,
Steve
The following shows what I put in and what I get back with show run or show access-lists 5
What I put in:
ip access-list standard 5
remark ACL for VTY access
remark Network Engineers
permit a.b.c.81
permit a.b.c.130
permit a.b.c.173
permit a.b.c.183
permit a.b.c.201
permit a.b.c.202
permit a.b.c.205
permit a.b.c.206
permit a.b.c.207
permit a.b.c.208
permit a.b.c.209
remark VPN Connection
permit 10.8.11.2
permit 10.8.11.3
permit 10.8.11.4
permit 10.8.11.5
permit 10.8.11.6
remark Network Management Systems
permit 10.8.100.0 0.0.0.255
access-list 5 remark Allow all net devices to connect to all net devices
permit 0.0.0.252 255.255.255.0
permit 0.0.0.253 255.255.255.0
permit 0.0.0.254 255.255.255.0
permit 192.168.51.0 0.0.0.255
permit 192.168.52.0 0.0.0.255
permit 10.8.1.0 0.0.0.255
permit 10.16.1.0 0.0.0.255
permit 10.24.1.0 0.0.0.255
permit 10.32.1.0 0.0.0.255
permit 10.40.1.0 0.0.0.255
permit 10.48.1.0 0.0.0.255
permit 10.56.1.0 0.0.0.255
permit 10.72.1.0 0.0.0.255
permit 10.80.1.0 0.0.0.255
deny any log
What I get with show run or show ip access-list 5
access-list 5 permit a.b.c.208
access-list 5 permit a.b.c.209
access-list 5 permit 10.8.11.3
access-list 5 remark VPN Connection
access-list 5 permit 10.8.11.2
access-list 5 permit 10.8.11.5
access-list 5 permit 10.8.11.4
access-list 5 permit 10.8.11.6
access-list 5 permit a.b.c.201
access-list 5 permit a.b.c.202
access-list 5 permit a.b.c.205
access-list 5 permit a.b.c.206
access-list 5 permit a.b.c.207
access-list 5 permit a.b.c.130
access-list 5 permit a.b.c.183
access-list 5 permit a.b.c.173
access-list 5 remark ACL for VTY access
access-list 5 remark Network Engineers
access-list 5 permit a.b.c.81
access-list 5 remark Network Management Systems
access-list 5 permit 10.8.100.0 0.0.0.255
access-list 5 remark Allow all net devices to connect to all net devices
access-list 5 permit 0.0.0.252 255.255.255.0
access-list 5 permit 0.0.0.253 255.255.255.0
access-list 5 permit 0.0.0.254 255.255.255.0
access-list 5 permit 192.168.51.0 0.0.0.255
access-list 5 permit 192.168.52.0 0.0.0.255
access-list 5 permit 10.8.1.0 0.0.0.255
access-list 5 permit 10.16.1.0 0.0.0.255
access-list 5 permit 10.24.1.0 0.0.0.255
access-list 5 permit 10.32.1.0 0.0.0.255
access-list 5 permit 10.40.1.0 0.0.0.255
access-list 5 permit 10.48.1.0 0.0.0.255
access-list 5 permit 10.56.1.0 0.0.0.255
access-list 5 permit 10.72.1.0 0.0.0.255
access-list 5 permit 10.80.1.0 0.0.0.255
access-list 5 deny any log
03-31-2005 01:20 PM
Steve
Other than the reordering to put host entries before more general entries I have not been aware that Cisco did other reordering (and believe that in most of my experience standard lists generally follow the rule of listing in the order entered). Clearly that is not happening with your list. And I have no explanation for it. Perhaps some of the Cisco folk can help us understand what is happening.
HTH
Rick
03-31-2005 07:48 PM
why?
05-05-2008 08:35 AM
I am getting the same behavior on a 2611 router with 12.1(27). Remark statements are getting moved around which makes them useless. Also, I have noticed that IOS seems to want similarly numbered host addresses listed with in descending order.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide