access-list [line-num]

[otnj2ee]

Too often I see in the access-list statement, there is a line number set to 1, like this:

access-list id_test 1 permit...

The doc's desc says: "The line number at which to insert a remark or an access control element (ACE)."

I can understand its "wording", but never "truly" understand it. :)

Could anybody explain it by giving an example?

Thanks to help.

Scott

[gfullage]

This came in in 6.3 code or thereabouts I think. It's basically a way to give you more control over how you edit your access-lists. Let's take an easy example of just adding in a new ACL:

pix(config)# access-list test permit udp any any

pix(config)# access-list test permit icmp any any

pix(config)# access-list test permit tcp any host 1.1.1.1 eq www

pix(config)#

pix(config)# sho access-list test

access-list test; 3 elements

access-list test line 1 permit udp any any (hitcnt=0)

access-list test line 2 permit icmp any any (hitcnt=0)

access-list test line 3 permit tcp any host 1.1.1.1 eq www (hitcnt=0)

You can see that when you add in an ACL it automatically gives each line a number starting at 1, incrementing by 1. Now with the above ACL, let's say I wanted to deny WWW access from a specific host to 1.1.1.1, this line would have to go above line 3 otherwise it would never get hit. Without line numbers I would normally have to remove the entire ACL, and retype it in putting my new line in before the old line 3.

With line numbering I can say I want this new line that I'm typing in to go in ABOVE the existing line number. So if I type the following:

pix(config)# access-list test line 3 deny tcp host 2.2.2.2 host 1.1.1.1 eq www

pix(config)# sho access-list test

access-list test; 4 elements

access-list test line 1 permit udp any any (hitcnt=0)

access-list test line 2 permit icmp any any (hitcnt=0)

access-list test line 3 deny tcp host 2.2.2.2 host 1.1.1.1 eq www (hitcnt=0)

access-list test line 4 permit tcp any host 1.1.1.1 eq www (hitcnt=0)

See how my new line is slotted in directly above where I specified, a lot easier than having to remove and reapply the entire ACL.

[jackko · Accepted solution]

pix(config)# sh access-list id_test

access-list id_test; 5 elements

access-list id_test line 1 permit gre any host 1.1.1.1 (hitcnt=0)

access-list id_test line 2 permit gre any host 2.2.2.2 (hitcnt=0)

access-list id_test line 3 permit gre any host 3.3.3.3 (hitcnt=0)

access-list id_test line 4 permit gre any host 4.4.4.4 (hitcnt=0)

access-list id_test line 5 permit gre any host 5.5.5.5 (hitcnt=0)

pix(config)# access-list id_test line 2 remark hello

pix(config)# sh access-list id_test

access-list id_test; 5 elements

access-list id_test line 1 permit gre any host 1.1.1.1 (hitcnt=0)

access-list id_test line 2 remark hello

access-list id_test line 3 permit gre any host 2.2.2.2 (hitcnt=0)

access-list id_test line 4 permit gre any host 3.3.3.3 (hitcnt=0)

access-list id_test line 5 permit gre any host 4.4.4.4 (hitcnt=0)

access-list id_test line 6 permit gre any host 5.5.5.5 (hitcnt=0)

pix(config)# access-list id_test line 1 permit icmp any host 1.1.1.1

pix(config)# sh access-list id_test

access-list id_test; 6 elements

access-list id_test line 1 permit icmp any host 1.1.1.1 (hitcnt=0)

access-list id_test line 2 permit gre any host 1.1.1.1 (hitcnt=0)

access-list id_test line 3 remark hello

access-list id_test line 4 permit gre any host 2.2.2.2 (hitcnt=0)

access-list id_test line 5 permit gre any host 3.3.3.3 (hitcnt=0)

access-list id_test line 6 permit gre any host 4.4.4.4 (hitcnt=0)

access-list id_test line 7 permit gre any host 5.5.5.5 (hitcnt=0)

TRIS-NOC-FW1(config)#

the golden rule of acl is that it works in order, from top to the bottom. with line number, you can specifically insert the new acl entry or remark wherever you prefer.

e.g. imagine you've got a 200-entry acl, and now you want to permit a host before other deny entries. of course you don't want to interupt the network by un-apply and re-apply the entire acl. in this case, line number saves the life.