Here are sample configuration on resequencing access lists in Cisco Routers for IOS, IOS-XE, IOS-XR and Nexus OS
Cisco IOS/IOS-XE
a. Show the existing access-list
IOS#show access-lists acl_123
Extended IP access list acl_123
10 permit tcp 192.168.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
20 permit tcp 172.16.0.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
30 deny ip any any
b. Add the new access list before the last deny rule
IOS(config)#ip access-list extended acl_123
IOS(config-ext-nacl)#21 permit tcp host 192.168.11.8 host 192.168.20.5 eq 22
IOS(config-ext-nacl)#22 permit tcp host 172.16.1.10.8 host 192.168.20.5 eq 22
c. Commit configuration (Not applicable for IOS & IOS-XE, it will take effect right away once config. You can do “copy run start” to save configuration)
d. Show the new access-list
IOS#show access-lists acl_123
Extended IP access list acl_123
10 permit tcp 192.168.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
20 permit tcp 172.16.0.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
21 permit tcp host 192.168.11.8 host 192.168.20.5 eq 22
22 permit tcp host 172.16.1.10.8 host 192.168.20.5 eq 22
30 deny ip any any
e. Resequence (under the global configuration mode)
ip access-list resequence <ACL NAME> <START NUMBER> <INCREMENT>
<1-2147483647> Starting Sequence Number
<1-2147483647> Step to increment the sequence number
Sample config:
IOS(config)#ip access-list resequence acl_123 10 10
f. Show the new access-list
IOS#show access-lists acl_123
Extended IP access list acl_123
10 permit tcp 192.168.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
20 permit tcp 172.16.0.10.8 255.255.255.255 192.168.20.5 255.255.255.255 eq 22
30 permit tcp host 192.168.11.8 host 192.168.20.5 eq 22
40 permit tcp host 172.16.1.10.8 host 192.168.20.5 eq 22
50 deny ip any any
Cisco IOS-XR
a. Show the existing access-list
RP/0/RSP0/CPU0:IOS-XR#show access-lists acl_123
ipv4 access-list acl_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
30 deny ipv4 any any
b. Add the new access list before the last deny rule
RP/0/RSP0/CPU0:IOS-XR(config)#ipv4 access-list acl_123
RP/0/RSP0/CPU0:IOS-XR(config-ipv4-acl)21 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
RP/0/RSP0/CPU0:IOS-XR(config-ipv4-acl)22 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
c. Commit configuration
RP/0/RSP0/CPU0:IOS-XR(config-ipv4-acl) commit
d. Show the new access-list
RP/0/RSP0/CPU0:IOS-XR#show access-lists acl_123
ipv4 access-list acl_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
21 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
22 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
30 deny ipv4 any any
e. Resequence (exit from the global configuration mode)
resequence access-list ipv4 <ACL NAME> <START NUMBER> <INCREMENT>
<1-2147483646> Starting number
<1-2147483646> Increment
Sample config:
RP/0/RSP0/CPU0:IOS-XR#resequence access-list ipv4 acl_123 10 10
f. Show the new access-list
RP/0/RSP0/CPU0:IOS-XR#show access-lists acl_123
ipv4 access-list acl_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
30 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
40 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
50 deny ipv4 any any
Cisco Nexus OS
a. Show the existing access-list
NX-OS# show ip access-lists acl_123
IP access list acl_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
30 deny ip any any
b. Add the new access list before the last deny rule
NX-OS(config-acl)#ip access-lists acl_123
NX-OS(config-acl)#21 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
NX-OS(config-acl)#22 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
c. Commit configuration (Not applicable for Nexus OS, it will take effect right away once config. You can do “copy run start” to save configuration)
d. Show the new access-list
NX-OS(config-acl)# show ip access-lists acl_123
IP access list ACL_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
21 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
22 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
30 deny ip any any
e. Resequence (exit from the global configuration mode)
resequence ip access-list <ACL NAME> <START NUMBER> <INCREMENT>
<1-4294967295> Starting sequence number
<1-4294967295> Step to increment the sequence number
Sample config:
NX-OS(config)# resequence ip access-list acl_123 10 10
f. Show the new access-list
NX-OS(config-acl)# show ip access-lists acl_123
IP access list ACL_123
10 permit tcp 192.168.10.8/32 192.168.20.5/32 eq 22
20 permit tcp 172.16.0.10.8/32 192.168.20.5/32 eq 22
30 permit tcp 192.168.11.8/32 192.168.20.5/32 eq 22
40 permit tcp 172.16.1.10.8/32 192.168.20.5/32 eq 22
50 deny ip any any
Be First to Comment