Solved: Adding Entry to existing Access List appears at the end of Access List

tariqmansoor · ‎05-04-2009

Hi guys,

I am having issues in adding new entries to an existing access list, When i add the entry to access list and then issue

 #sh access-lists

The new entries are at the end of Access List but i want them to appear on the top or in a place where i can control.

Is there any way we can do this with out removing all the entries and then putting them back as the router i am adding access list entries is a production router.

Thansk for your input.

Jon Marshall · ‎05-04-2009

As an example lets say you want to add a line into acl ACT between line 10 and line 20

ip access-list extended ACT

15 deny ip 10.26.0.0 0.0.0.255 172.16.10.0 0.0.0.255

Jon

View solution in original post

Jon Marshall · ‎05-04-2009

Really depends on what type of acl it is. If you do a

sh access-list

do you get numbered lines or not ?

If you don't then easiest thing to do is create a new acl in notepad which is a copy of your existing acl with the additional lines. Copy this back into the config and then simply update the acl under the interface ie.

int fa0/0

ip access-group in/out

Jon

tariqmansoor · ‎05-04-2009

Thansk i do get numbered line when i

sh access list

Extended IP access list 105

10 deny ip 10.26.0.0 0.0.0.255 10.10.10.0 0.0.0.255 (31573 matches)

20 deny ip 10.26.0.0 0.0.0.255 10.0.0.0 0.0.0.255

30 permit ip 10.26.0.0 0.0.0.255 any (2823 matches)

40 permit tcp any host 10.26.0.100 eq 3389

Extended IP access list ACT

10 permit ip 10.26.0.0 0.0.0.255 10.10.10.0 0.0.0.255 (796 matches)

20 permit ip 10.26.0.0 0.0.0.255 10.0.0.0 0.0.0.255

How Can we add new entry at our desired location in the Acces list.?

Cheers,

Jon Marshall · ‎05-04-2009

As an example lets say you want to add a line into acl ACT between line 10 and line 20

ip access-list extended ACT

15 deny ip 10.26.0.0 0.0.0.255 172.16.10.0 0.0.0.255

Jon

tkalfaoglu · ‎05-25-2023

Even when I enter my access list with numbers,

show run

shows the same access list without numbers..

my access list starts like:

ip access-list extended ACL-INFRASTRUCTURE-IN
10 deny tcp any any fragments
20 deny udp any any fragments

etc...

what can I do to preserve the line numbers?

many thanks, -t