Cisco Support Community
Community Member

Multiple ACL's on IOS 11.2(16) Help

On a 2514 with 11.2 IOS, I'm trying to implement multiple ACL's to block all access to about 55 host addresses. I cannot seem to put them all into one ACL, or the list just disappears, and I'm unclear on how properly to setup multiple lists of about 10 addresses each .

Does each list, say 101-105, need a "permit ip any any" at the end, or just the final list applied to the interface? Will the lists be processed in numerical order or in the order in which they're applied to the interface? I'm assuming that I would implement the lists inbound on the interface that has all the user machines for which I want to block these sites. All my PC's being on E0, I'll want to enter "ip access-group 101 in" for all the lists through 105, correct?

I purchased the Cisco Field Guide for Access Lists, but I cannot find anything about how multiple lists are processed. If there's a good resource online with the info I need, I'll really appreciate help finding it.

My thanks in advance.

Phil Hershey

Community Member

Re: Multiple ACL's on IOS 11.2(16) Help

Hi Phil,

There is a good chapter in the ACRC book by Cisco.

ACRC Advanced Cisco Router Configuration Study Guide

Please refer to the following web site

Which discribes all the various types and steps involved in access list.


Habib U Dashti

Community Member

Re: Multiple ACL's on IOS 11.2(16) Help

Hi, Phil,

Your post doesn't state what specific version of 11.2 IOS you're using, but I'm going to assume you're using a major release version that doesn't have bugs, etc.

Next, I'm going to assume that your 2514 (which you already know is "End-Of-Life, right?) has enough memory. Sometimes, when the ACL you're trying to create can't be made "large" enough, the underlying problem is not enough hardware memory. Since you're writing in real-time, there needs to be enough memory to store the access-list you're creating and subsequently running.

Last, your question seems to be asking if and how it's possible to apply multiple "access-group" ACL statements to a single interface. The quick and simple answer is that you can't.

In other words, you can't apply multiple IP "access-group" ACL's to the same interface like this:

config terminal

interface e0

ip access-group 101 in

ip access-group 102 in

ip access-group 103 in

In the above example, only the last time: "ip access-group 103 in" will be programmed into the router. The statements for ACL's 101 and 102 will seemingly disappear.

You can have one access-group list inbound and then another outbound:

ip access-group 101 in

ip access-group 102 out

If you want some on-line tips about access-lists, you might try one of these:

And of course, from Cisco:

(Be sure you copy and paste both lines...)

Last random thoughts:

1. If all the hosts are off of e0, I assume they're all on the same subnet. Are you defining specific statements for each PC or are you doing network statements?


access-list 102 ip permit

access-list 102 ip permit


Or this?

access-list 102 ip permit

or whatever (Much better). Since all 55 PC's are on the same internetwork, you should be able to group them all together...?

2. On the flip side, if there are some PC's on that network that can't be grouped with the PC's you're trying to block, can you list the networks that should be permitted instead? (That is, block the source rather then destination?)

3. If you place an "permit any any" on the end of each list, you are deliberately overriding the implicit "deny any any" at the end of each access-list.

4. Remember that the ordering of source and destination in access-lists is very important - especially if you use some lists as inbound and some as outbound. In other words, where is some network and w.x.y.z is one of your PC's:

access-list 102 ip permit host w.x.y.z

interface e0

access-group 102 in

access-list 103 ip permit host w.x.y.z

interface e0

access-group 103 ip out

... are roughly equivalent in terms of permissions. (I know someone out there reading this is going to yell at me...)

Hope this helps and good luck!

Community Member

Re: Multiple ACL's on IOS 11.2(16) Help

I just brilliantly noticed your subject line which states you're running 11.2(16).

Of course, that level of IOS is considerably backlevel, and I would highly recommend you work with your Cisco engineer to validate the correct level of code for your router and business needs.

CreatePlease to create content