Deleting ACL

[yee.lay.yo]

Hi All,

How can I remove single ACL line from my ACL list?

[Edison Ortiz]

Let's take this ACL as an example:

R2#sh ip access-lists

Extended IP access list 101

10 permit ip host 1.1.1.1 host 2.2.2.2

20 permit ip host 1.1.1.1 host 3.3.3.3

30 permit ip host 1.1.1.1 host 4.4.4.4

You noticed how the output has a number from 10 to 30 on each ACE?

Now, let's say I want to knock out line number 20.

R2(config)#ip access-list extended 101

R2(config-ext-nacl)#no 20 permit ip host 1.1.1.1 host 3.3.3.3

R2(config-ext-nacl)#end

R2#sh ip access-lists

Extended IP access list 101

10 permit ip host 1.1.1.1 host 2.2.2.2

30 permit ip host 1.1.1.1 host 4.4.4.4

HTH,

__

Edison.

Please rate helpful posts

[jamesl0112]

Edison,

That's pretty handy - I didn't know you could edit a numbered ACL as if it was a named ACL.

[gilbertktaylor43922]

Hi Edison,

That's a great post. One of the most succinct I've seen.

Thanks,

Gilbert

[Marwan ALshawi]

When you edit an ACL, it requires special attention. For example, if you intend to delete a specific line from a numbered ACL that exists as shown here, the entire ACL is deleted

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#editacls

Rate if helpful

[gojericho0]

Also, i believe you need at least version 12.3 of the IOS in order to delete numbered access-lists line by line

[AJAZ NAWAZ]

just tested on 65k with 12.2 - all good. I suspect this method has been available for longtime, it's just been hidden (not to be confused with 'hidden' commands).

Ajaz

[yee.lay.yo]

Hi Edison,

The problem fix by your instruction.

Thanks a lot.

[paul driver]

Hello
Just like to add you should be able to do this even with standard numbered acls and also be able to just to specify the ace number when deleting or adding an ace

Example1:

access-list 10 permit 10.10.10.0
access-list 10 permit 20.10.10.0

sh access-lists
Standard IP access list 10
10 permit 10.10.10.0
20 permit 20.10.10.0

ip access-list standard 10
no 20
20 permit  20.20.20.0

Example2:
access-list 101 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip 20.10.10.0 0.0.0.255 any

sh access-lists

Extended IP access list 101
10 permit ip 10.10.10.0 0.0.0.255 any
20 permit ip 20.10.10.0 0.0.0.255 any

ip access-list extended 101
no 20
20 permit  ip 20.20.20.0 0.0.0.255 any