1

I'm configuring a router for which I have an access list. I know what rules I want to configure, but I can't figure out how to change the sequence for my ip permit any any statement. Here is the result of do sh ip access-list:

Standard IP access list 1
    10 permit any (4539676 matches)
Extended IP access list aSheild
    10 permit ip any any
Extended IP access list aShield
    20 permit ip any any (7101310 matches)
    30 deny tcp any any eq ftp
    40 deny tcp any any eq ftp-data
    50 deny tcp any any eq www
    60 deny tcp any any eq telnet

So my question is two fold:
1. Why do I have two Extended IP access list aShield?
2. How can I get the permit ip any any to the bottom?

3 Answers 3

1
  1. one ACL name is probably misspelled
  2. the ACL entries are sorted by the sequence number at the beginning of a line - if you like a permit ip any any on the very bottom put it on 9999 or 99999
3
  • Good point of the misspelling, I'll delete that list. And I know that that's what I need to do, but I can't find any documentation on what that command looks like Jan 4, 2018 at 18:38
  • I guess it's in the manual - just 9999 permit ip any any will do. no 20 will get rid of the line on top.
    – Zac67
    Jan 4, 2018 at 18:48
  • Awesome, that worked!! Thank you so much!! Jan 4, 2018 at 18:49
1

Why do I have two Extended IP access list aShield?

A. You don't - check the spelling aSheild & aShield

How can I get the permit ip any any to the bottom?

A.

ip access-list extended aShield
no 20
70 permit ip any any 

You can also get rid of the other access-list with

no ip access-list aSheild

You can also sort an access list with

ip access-list resequence aSheild 10 10

The two 10's represent the starting number and the increments

0

It's easier to just blow out the ACL and add it back in with the correct sequence. You can delete a specific line of an ACL with no 20 but it would be simpler to do this.

>

 no ip access list sShield 
 ip access-list extended aShield
>     deny tcp any any eq ftp
>     deny tcp any any eq ftp-data
>     deny tcp any any eq www
>     deny tcp any any eq telnet
>     permit ip any any (7101310 matches)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.