cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
18367
Views
30
Helpful
9
Replies

How to Add remarks to an existing ACL

Cisco Junky
Level 1
Level 1

Hi,

I am going to be editing an existing extended ACL adding 2 permit lines,(using ACL sequence numbers) but I also want to include remarks.

How do I do this with out having to re-write the entire list, and causing downtime?

You help is much appreciated

9 Replies 9

anoop.verma
Level 1
Level 1

Viewing Access Control Lists (ACLs) can be somewhat confusing because the ACLs will all run together. Adding remarks to your ACLs will make them easier to read. When you look at your running-config to view the ACLs without remarks, as shown here:

Switch1#show running-config | include access-list
access-list 50 deny   192.168.8.200
access-list 50 deny   192.168.8.201
access-list 50 permit 192.168.8.0 0.0.0.255
access-list 50 permit 192.168.9.0 0.0.0.255
access-list 60 permit 192.168.8.0 0.0.0.3
access-list 60 deny   192.168.8.0 0.0.0.255
access-list 60 deny   192.168.9.0 0.0.0.255

To make this easier to read, you should start each ACL with a remark line. This does not show up when using the show command; but is in yourrunning-config. This is what it would look like:

Switch1#show running-config | include access-list
access-list 50 deny   192.168.8.200
access-list 50 deny   192.168.8.201
access-list 50 permit 192.168.8.0 0.0.0.255
access-list 50 permit 192.168.9.0 0.0.0.255
access-list 60 remark This ACL is to control the outbound router traffic.
access-list 60 permit 192.168.8.0 0.0.0.3
access-list 60 deny   192.168.8.0 0.0.0.255
access-list 60 deny   192.168.9.0 0.0.0.255

Hi there,

I have an existing ACL

access-list 111 permit ip any host 1.1.1.1

access-list 111 permit ip any host 2.2.2.2

access-list 111 permit ip any host 3.3.3.3

access-list 111 deny ip any any

I want to add a new like to permit host 4.4.4.4 but before have a remark saying Test_4.4.4.4 I cant see syntax to complete this.

I will use the show access-list 111 and then use the spare sequence number between the host 3.3.3.3 and the deny any statement to add the new line, however I cannot add a remark this way.

Any solution?

On which device you are creating acl ?

6509.

I believe the only way is to remove the line "access-list 111 deny ip any any"

add the remark and the new permit statement

Re-enter the line "access-list 111 deny ip any any"

The implicit deny any any will cover this so the ACL will be fully operational at all time?

do you agree

Hi,

Lets say the spare sequence number is 35

conf t

!

ip access-list extended 111

35 permit ip any host 4.4.4.4

remark *** TESTING 4.4.4.4 ***

end

However you will not see the remark in show access-list

You need to issue

show run | beg access-list

to see any remarks

Regards

Alex

Regards, Alex. Please rate useful posts.

Hi,

This is not correct... the remark statement will then be placed underneath the "deny any any" statement.

If you place your remark prior to the line with the sequence number, it will show up in the right order.  Your remark should come before the line that you are adding the remark for.  Example:

conf t

!

ip access-list extended 111

remark *** TESTING 4.4.4.4 ***

35 permit ip any host 4.4.4.4

end

 

If you do it that way it should show up in the correct order.

I guess this is long time since your post but THANKS. Everywhere I looked it was always:

1)do new ACL and replace the old one

2)do the lines and then resequence

 

This needs more recognition!

Hello

 

example:

sh access-lists
(spare sequence number of 40)

ip access-list extended 111
40 permit ?????? etc..
exit

ip access-list resequence 111   10 5

res
Paul


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: