Dear Community,
I feel like such a noob for asking this question but I ran into an interesting issue today wherein my router was not NATing traffic from an address that I had specified in my ACL. I wanted to add a couple of additional IPs to the ACL that was being referenced by the following statement:
ip nat inside source list 10 pool FIS overload
So I went ahead and added the IP's I wanted to add via the following:
(config)# access-list 10 permit 10.110.14.120
(config)# access-list 10 permit 10.110.14.121
(config)#show ip access-lists 10
Standard IP access list 10
40 permit 10.110.14.120
50 permit 10.110.14.121
10 permit 10.110.14.15 (967874 matches)
30 permit 10.110.14.26 (50 matches)
20 permit 10.110.14.16 (964860 matches)
No problem right? except for the fact that when I ran a show ip nat translations, the addresses were not being translated and the ACEs referencing the new IPs were not being matched. I eventually decided to write them in another way
(config)# ip access-list standard 10
(config-std-nacl)# permit 10.110.14.120
(config-std-nacl)# permit 10.110.14.121
After doing this it worked! So I guess my question is, does it always matter the way that the original IP Access list was written? It appears that this ACL was originally written in the latter way, so when I tried to add ACEs in the (config)# access-list 10 permit x.x.x.x way it failed, eventhough the ACEs showed up in the ACL, even after writing them in the "wrong" way.
(config)#show ip access-lists 10
Standard IP access list 10
40 permit 10.110.14.120 (2 matches)
50 permit 10.110.14.121 (2 matches)
10 permit 10.110.14.15 (967874 matches)
30 permit 10.110.14.26 (50 matches)
20 permit 10.110.14.16 (964860 matches)
