17

For Cisco routers and switches, is there a show command, or something similar, that will display what physical and logical interfaces an ACL is implemented on and what direction it is applied in?

I am looking for something simpler than a show run | <some regex>.

18

I don't believe that there is anything simpler than show interfaces | <some regex> unfortunately.

Edit:

From the comments below, @Santino pointed out a more concise RegEx:

show ip interface | include line protocol|access list

My testing so far indicates that this gives the same results as my longer RegEx below.


I usually use the following to find where ACLs are applied:

show ip interface | include is up|is administratively|is down|Outgoing|Inbound

This gives you every interface, no matter the state, then what the Outbound and Inbound ACL's are. For example:

LAB-4510-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound 
Vlan1 is administratively down, line protocol is down
Vlan110 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is VENDOR->INTERNET
Vlan140 is administratively down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is not set
Vlan150 is down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is VENDOR->INTERNET
Vlan210 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
FastEthernet1 is administratively down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet1/1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet1/2 is down, line protocol is down
  Inbound  access list is not set
  Outgoing access list is not set

And so on for every interface.


This command works on both Cisco switches and routers. See sample output from a 7200 Router below:

LAB-7204-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound
GigabitEthernet0/1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
FastEthernet0/2 is administratively down, line protocol is down
GigabitEthernet0/2 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet0/3 is administratively down, line protocol is down
SSLVPN-VIF0 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
Loopback0 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
Loopback1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
  • 3
    You could probably shorten that to show ip interface | include line protocol|access list For NX-OS, show ip access-list summary – Santino Jul 28 '13 at 17:59
  • 1
    @Santino, True! I will edit my answer accordingly. Also, in doing further research, I also see that Jeremy Stretch over at PacketLife has already been down this road with another shorter RegEx (but not as short as yours): show ip interface | include line protocol|access list is [^ ]+$ I'm not sure if there's a reason we need the extra RegEx matching after "access list". – Brett Lykins Jul 28 '13 at 18:04
  • 2
    Stretch's regex will filter out access list lines that are not set. The end of his regex matches a single word, which would match an ACL since they cannot have spaces. Good find. – Santino Jul 28 '13 at 18:21
  • 1
    @Santino, that makes sense! Thanks for the explanation. After going back to Stretch's page I saw the explanation there too... ::Reading fail:: on my part :) – Brett Lykins Jul 28 '13 at 18:43
3

If you have a show run | <some regex> command you like that displays the information you need, you could always make an alias.

An example using this command: alias exec shacls sh ip int | inc line protocol|access list is [^ ]+$.

Then you can just use alias-name (in this instance shacls) and it will be the same as show run | <some regex>

Note: You would need to do this on each IOS device. ASAs are slightly different.

Edit: I can't take credit for sh ip int | inc line protocol|access list is [^ ]+$ as that was from PacketLife IOS Tips.

1

I was messing with this earlier and found a pretty straighforward regex that should give you what you want.

sho ip int | inc ^[A-Z]|access list

The list is needed to ignore access violations line.

1

I remember it this way. Easiest and shortest to remember for me.

sh ip int | i line|list
  • nice and concise – Jeff Wright Jan 28 '16 at 19:03
0

show ip interface should do the trick.

0

sh run | in ^inter|access-gr

gives output from the running-config

  • Could you edit the question to explain how this command works? – jwbensley Feb 7 '14 at 9:30
-1

On Nexus devices you can issue show access-list summary or show ip access-list summary

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.