ACL Remark Ordering

[davidhuynh5]

I would like the remark on acl 13 to appear at the beginning of the configuration, so that when an engineer looks at the acl, it can be quicly identified.  However, it does not happend.  Why does this happen and how can I fix it? Thanks in advance.

no access-list 13

access-list 13 remark Permit TFTP Servers

access-list 13 permit 10.8.4.201

access-list 13 permit 10.8.4.202

access-list 13 permit 10.6.160.198

access-list 13 permit 10.6.160.199

access-list 13 permit 10.6.160.200

access-list 13 permit 10.6.160.201

!

end

switch#sh run | b access-list 13

access-list 13 permit 10.6.160.200

access-list 13 permit 10.6.160.201

access-list 13 permit 10.6.160.198

access-list 13 permit 10.6.160.199

access-list 13 permit 10.8.4.202

access-list 13 remark Permit TFTP Servers <----it's not at the top.

access-list 13 permit 10.8.4.201

[Latchum Naidu]

Hi,

That can be because, the access list happens to use a permit statement first, but a deny statement could appear first, depending on the order of statements you need.

Please rate the helpfull posts.
Regards,
Naidu.

[Amit Aneja · Accepted solution]

What you are seeing is expected. There was a bug filed on this few years ago. Bug ID is

CSCdm59696, you could see the details in Cisco Bug tool kit.

This bug was closed because of the following reason:

To speed up processing of standard access lists, we hash the

exact-match entries. This is why they appear in a different order as

entered when they are output by the 'show ...' commands. This

appearance of reordering does not reflect the actual order of

evaluation.

So, the answer to your question is that we cannot fix this.

HTH,

Amit