cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2011
Views
0
Helpful
4
Replies

Can you disable a single line within ACL?

parsonsproject1
Level 1
Level 1

We have 881g on 15.1 code with a ZBFW.

Within an ACL, ip access-list extended blah, with multiple lines, 10,20,30,etc... is there a way to disable a single line or make it inactive while still leaving it in config? Don't see it in there, not sure if it's not possible or I'm not looking at the right things.

Thanks!

1 Accepted Solution

Accepted Solutions

There is no 'inactive' like on the ASA. A work around would be to do something like

remark permit tcp any any eq smtp established log

It keeps it in the config, but it doesn't do anything since it's a remark.

View solution in original post

4 Replies 4

Collin Clark
VIP Alumni
VIP Alumni

View the ACL (show access-list)

FIREWALL#sh access-list inbound

Extended IP access list inbound

    10 deny ip 0.0.0.0 0.255.255.255 any log

    20 deny ip host 255.255.255.255 any log

    30 permit tcp any any eq smtp established log

    40 deny ip 127.0.0.0 0.255.255.255 any log

Then go into the ACL and remove the line you want.

FIREWALL#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

FIREWALL(config)#ip access-list ext inbound

FIREWALL(config-ext-nacl)#no 30 permit tcp any any eq smtp established log

FIREWALL(config-ext-nacl)#end

FIREWALL#sh access-list inbound

Extended IP access list inbound

    10 deny ip 0.0.0.0 0.255.255.255 any log

    20 deny ip host 255.255.255.255 any log

    40 deny ip 127.0.0.0 0.255.255.255 any log

    50 deny ip 10.0.0.0 0.255.255.255 any log

Thanks, I know how to remove a line within the ACL, but that is not what I'm looking for. I still want the line to be in there, just inactive. Similar to how you can specify an ACE on an ASA with the 'inactive' word at the end. Is this possible with router running ZBFW on 15.1 code?

There is no 'inactive' like on the ASA. A work around would be to do something like

remark permit tcp any any eq smtp established log

It keeps it in the config, but it doesn't do anything since it's a remark.

Thanks Collin looks like that is the closest we're going to get.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: