10

Consider the following access-list:

access-list 25 remark city1
access-list 25 permit 10.1.120.0 0.0.0.255
access-list 25 remark city2
access-list 25 permit 10.2.120.0 0.0.0.255
access-list 25 remark city3
access-list 25 permit 10.3.120.0 0.0.0.255
access-list 25 remark city4
access-list 25 permit 10.4.120.0 0.0.0.255
access-list 25 remark city5
access-list 25 permit 10.5.120.0 0.0.0.255
access-list 25 remark mgt
access-list 25 permit 10.3.66.86
access-list 25 remark jumphosts
access-list 25 permit 10.3.1.37
access-list 25 permit 10.3.1.38

If I enter this directly into a router in the order above and then run "show ip access-list 25" the access-list is displayed in the following order:

Standard IP access list 25
    60 permit 10.3.66.86
    70 permit 10.3.1.37
    80 permit 10.3.1.38
    10 permit 10.1.120.0, wildcard bits 0.0.0.255
    20 permit 10.2.120.0, wildcard bits 0.0.0.255
    30 permit 10.3.120.0, wildcard bits 0.0.0.255
    40 permit 10.4.120.0, wildcard bits 0.0.0.255
    50 permit 10.5.120.0, wildcard bits 0.0.0.255

If I view the access list in the running-config it appears in this order:

access-list 25 remark mgt
access-list 25 permit 10.3.66.86
access-list 25 remark jumphosts
access-list 25 permit 10.3.1.37
access-list 25 permit 10.3.1.38
access-list 25 remark city1
access-list 25 permit 10.1.120.0 0.0.0.255
access-list 25 remark city2
access-list 25 permit 10.2.120.0 0.0.0.255
access-list 25 remark city3
access-list 25 permit 10.3.120.0 0.0.0.255
access-list 25 remark city4
access-list 25 permit 10.4.120.0 0.0.0.255
access-list 25 remark city5
access-list 25 permit 10.5.120.0 0.0.0.255

Questions:

1) Why doesn't the access list appear in the order that it was entered?
2) Even though it isn't displayed in the correct order in "show ip access-lists" output or in the running config, the sequence numbers are in order. Is the ruleset parsed according to the sequence numbers or according to the order in which the entries are displayed?

Cisco IOS 15.1(4)M5

14

From the Cisco documentation:

The major difference in a standard access list is that the Cisco IOS adds an entry by descending order of the IP address, not on a sequence number.

You can read more here.

| improve this answer | |
-1

Here's an earlier take on this.

https://learningnetwork.cisco.com/thread/15432

Look up Carlos' reply.

https://supportforums.cisco.com/t5/lan-switching-and-routing/access-list-wrong-order/td-p/3070419

Please look that up, Peter Paluch's post. ;)

| improve this answer | |
  • 1
    Link-only answers are highly discouraged because links fail over time. You should include the relevant information in your answer and properly attribute it and include the link. – Ron Maupin Jun 2 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.