cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

5550
Views
10
Helpful
9
Replies
Beginner

How to Add remarks to an existing ACL

Hi,

I am going to be editing an existing extended ACL adding 2 permit lines,(using ACL sequence numbers) but I also want to include remarks.

How do I do this with out having to re-write the entire list, and causing downtime?

You help is much appreciated

9 REPLIES 9
Beginner

Viewing Access Control Lists

Viewing Access Control Lists (ACLs) can be somewhat confusing because the ACLs will all run together. Adding remarks to your ACLs will make them easier to read. When you look at your running-config to view the ACLs without remarks, as shown here:

Switch1#show running-config | include access-list
access-list 50 deny   192.168.8.200
access-list 50 deny   192.168.8.201
access-list 50 permit 192.168.8.0 0.0.0.255
access-list 50 permit 192.168.9.0 0.0.0.255
access-list 60 permit 192.168.8.0 0.0.0.3
access-list 60 deny   192.168.8.0 0.0.0.255
access-list 60 deny   192.168.9.0 0.0.0.255

To make this easier to read, you should start each ACL with a remark line. This does not show up when using the show command; but is in yourrunning-config. This is what it would look like:

Switch1#show running-config | include access-list
access-list 50 deny   192.168.8.200
access-list 50 deny   192.168.8.201
access-list 50 permit 192.168.8.0 0.0.0.255
access-list 50 permit 192.168.9.0 0.0.0.255
access-list 60 remark This ACL is to control the outbound router traffic.
access-list 60 permit 192.168.8.0 0.0.0.3
access-list 60 deny   192.168.8.0 0.0.0.255
access-list 60 deny   192.168.9.0 0.0.0.255
Highlighted
Beginner

Hi there,

Hi there,

I have an existing ACL

access-list 111 permit ip any host 1.1.1.1

access-list 111 permit ip any host 2.2.2.2

access-list 111 permit ip any host 3.3.3.3

access-list 111 deny ip any any

I want to add a new like to permit host 4.4.4.4 but before have a remark saying Test_4.4.4.4 I cant see syntax to complete this.

I will use the show access-list 111 and then use the spare sequence number between the host 3.3.3.3 and the deny any statement to add the new line, however I cannot add a remark this way.

Any solution?

Beginner

On which device you are

On which device you are creating acl ?

Beginner

6509.

6509.

I believe the only way is to remove the line "access-list 111 deny ip any any"

add the remark and the new permit statement

Re-enter the line "access-list 111 deny ip any any"

The implicit deny any any will cover this so the ACL will be fully operational at all time?

do you agree

Advocate

Hi,

Hi,

Lets say the spare sequence number is 35

conf t

!

ip access-list extended 111

35 permit ip any host 4.4.4.4

remark *** TESTING 4.4.4.4 ***

end

However you will not see the remark in show access-list

You need to issue

show run | beg access-list

to see any remarks

Regards

Alex

Regards, Alex. Please rate useful posts.
Beginner

Hi,

Hi,

This is not correct... the remark statement will then be placed underneath the "deny any any" statement.

Beginner

Re: Hi,

If you place your remark prior to the line with the sequence number, it will show up in the right order.  Your remark should come before the line that you are adding the remark for.  Example:

conf t

!

ip access-list extended 111

remark *** TESTING 4.4.4.4 ***

35 permit ip any host 4.4.4.4

end

 

If you do it that way it should show up in the correct order.

Re: Hi,

I guess this is long time since your post but THANKS. Everywhere I looked it was always:

1)do new ACL and replace the old one

2)do the lines and then resequence

 

This needs more recognition!

VIP Advisor

Re: Hi there,

Hello

 

example:

sh access-lists
(spare sequence number of 40)

ip access-list extended 111
40 permit ?????? etc..
exit

ip access-list resequence 111   10 5

res
Paul



kind regards
Paul

Please rate and mark posts accordingly if you have found any of the information provided useful.
It will hopefully assist others with similar issues in the future
CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards