How to delete a MAC address in filter

[Thai Nguyen Duc]

Hi all,

I am writing CLI to block some MAC address.

for example:

access-list 705 deny 7831.c181.d8ff 0000.0000.0000

access-list 705 deny 4404.4470.a7a0 0000.0000.0000

access-list 705 deny c4b3.0118.5258 0000.0000.0000

But I took mistake for a MAC address.

so I want to delete a access-list 705 deny 7831.c181.d8ff 0000.0000.0000

It is as below right ? CLI:

no access-list 705 deny 7831.c181.d8ff 0000.0000.0000

I am not use because when I do like this.

All MAC address was deleted.

I cannot see any MAC address as show access-list 705

so my question is that, How to delete only one MAC address that still keep other MAC address.

Thanks 

[Sandeep Choudhary]

just use this command:

no access-list 705 deny 7831.c181.d8ff 0000.0000.0000

Regards

Dont forget to rate helpful posts

[Thai Nguyen Duc]

when I use this command :

no access-list 705 deny 7831.c181.d8ff 0000.0000.0000

and show access-list 705

But cannot see any MAC Address .

it seem to delete all MAC address .

I attached file

[Sandeep Choudhary]

Yes.. there is a limitation using CLI  to create and remove the Access-list with same number.

Better to use diff access-list <705/706> numbers.

example:

access-list 705 permit ab1d.e08d.1103 0000.0000.0000

access-list 705 permit 5h59.4835.3b83 0000.0000.0000

access-list 706 permit cd1f.e10e.b422 0000.0000.0000

access-list 706 permit 78e4.0038.7e45 0000.0000.0000

access-list 706 permit ef1b.7745.c576 0000.0000.0000

Regards

Dont forget to rate helpful posts

[Thai Nguyen Duc]

Hi 

another issue.

do you have any link related CLI for AP cisco ?

[Sandeep Choudhary]

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116582-configure-ap-00.html

http://www.cisco.com/c/en/us/td/docs/wireless/access_point/15-3-3/configuration/guide/cg15-3-3/cg15-3-3-chap16-filters.html

Regards

Dont forget to rate helpful posts

[Minh]

Hi Thai, I have the same issue of deleting the MAC filter address. Could you share the solution? Thanks Minh

[Rich R]

@Minh  see the answer from @Sandeep Choudhary above.
You can only add and delete the entire ACL - they cannot be edited like modern IP ACLs.
An alternative is to create a new ACL (706 in Sandeep's example), then switch from using 705 to 706 and then you can delete 705 after you have switched.

[Minh]

Hi Rich, Thanks a lot for your help!

[Jens Albrecht]

As already explained in this thread it is not possible to edit this type of ACLs.
Therefore, I continue to use the good old editor method for longer ACLs that we had to use back in those days when even IP ACLs could not be edited:

• Do a "show run | in access-list 706" (again based on Sandeep's example)
• Copy the output to the text editor of your choice and modify the ACL as required
• Delete the entire ACL on the device with "no access-list 706"
• Copy the modified ACL from your text editor to the device
• Verify the modified ACL on the device with show commands

Very old-fashioned but it's working.

HTH!

[Minh]

Jens, Many thanks for the clear and detailed breakdown.