7

I have a Cisco Router 1941 Series and I want to make some changes to the access-list on the router. I got to know I will have to delete one of the list and then re-add everything again with my additional ones included while stating the deny ones at the end of it. On removing, it went well but on adding, it hangs after the first statement. And whenever I try pasting the code at once, it hangs too.

I tried copying the file to tftp, make some edits and then bring it back, I got some errors with the certificate signing side of it making some complaints.. How can I solve the problem with the ACL?

[Edit]

At the present, this is what I have,

interface GigabitEthernet0/0
 description ### WAN INTERFACE ###
 ip address xxx.xxx.xxx.xxx 255.xxx.xxx.xxx
 ip flow ingress
 ip nat outside
 ip virtual-reassembly
 duplex full
 speed 100
 no cdp enable
!
interface GigabitEthernet0/1
 description ### LAN INTERFACE ###
 no ip address
 ip flow ingress
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface GigabitEthernet0/1.1
 description ### 1st FLR NETWORK ###
 encapsulation dot1Q 1 native
 ip address 192.168.1.1 255.255.255.0
 ip access-group 110 in
 ip accounting output-packets
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
!
interface GigabitEthernet0/1.2
 description ### GROUND FLR NETWORK ###
 encapsulation dot1Q 2
 ip address 192.168.2.1 255.255.255.0
 ip access-group 110 in
 ip accounting output-packets
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
!
ip forward-protocol nd
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-export source GigabitEthernet0/1
ip flow-export version 9
ip flow-export destination 192.168.1.120 9996
ip flow-top-talkers
 top 10
 sort-by bytes
!
ip nat source static 192.168.1.19 interface Loopback100
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 xxx.vvv.vvv.vvv
!
ip access-list standard NAT
 permit 192.168.1.0 0.0.0.255
 permit 192.168.2.0 0.0.0.255
!
access-list 110 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
access-list 110 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255
access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18
access-list 110 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
access-list 110 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 110 permit udp any any
access-list 110 permit ip any any

And I would like to add additional ones to it... like this...

access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120
access-list 110 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222
access-list 110 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
Improve this question
3
  • Thank you for asking; please consider adding more details to the question. At a minimum, we need to see the original ACL, which interface(s) it's applied to, and the details of how you are changing it for each failed attempt above.
    – Mike Pennington
    Mar 26, 2014 at 9:05
  • The changes I want to make is to give access to for 192.168.1.222 and 192.168.1.120 on the 192.168.2. network so they pull data to the respective servers for monitoring. So I did tried removing part of the list to remove everything and on adding, it anyone, it hangs and I have to restart the router
    – Laredo
    Mar 26, 2014 at 10:16
  • Were you able to reorganize your ACL? Do you still need assistance? If so, please join the NE chat and let me know how I can assist
    – Mike Pennington
    Mar 28, 2014 at 8:44

3 Answers 3

Reset to default
16

The reason your router hangs is because you're editing the ACL through the same interface that it's applied to. Usually what happens is you wind up blocking yourself accidentally.

Note that I make a suggestion for reorganizing your ACLs at the bottom of this answer, although most people will be interested in this first section (the easiest way to change ACLs).

The easiest way to change Cisco IOS ACLs

Newer Cisco IOS images (such as the image on your Cisco 1941) support IP access-list line numbering, which means you can modify your ACL without removing it...

I will use the example of your original ACL 110, although as I mentioned you should really consider reorganizing your ACLs into two different ACLs.

Step 1, ACL 110 already on the router:

LAB_RTR#sh access-list 110
Extended IP access list 110
    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255
    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18
    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
    50 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    60 permit udp any any
    70 permit ip any any

Take note of the line numbers that Cisco automatically added to ACL 110. Remember that you need to add your ACL entries before line 50, due to the deny statement.

Step 2, Modify ACL 110 in place with new entries, starting after line 40:

LAB_RTR#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
LAB_RTR(config)#ip access-list extended 110
LAB_RTR(config-ext-nacl)#41 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120
LAB_RTR(config-ext-nacl)#42 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
LAB_RTR(config-ext-nacl)#43 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222
LAB_RTR(config-ext-nacl)#44 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
LAB_RTR(config-ext-nacl)#end
LAB_RTR#
LAB_RTR#
LAB_RTR#
LAB_RTR#sh access-list 110
Extended IP access list 110
    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255
    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18
    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
    41 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120
    42 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
    43 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222
    44 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
    50 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    60 permit udp any any
    70 permit ip any any
LAB_RTR#

Step 3, Renumber the ACL, automatically:

The automatic line numbers are nice, because Cisco also gives you a way to renumber the config...

LAB_RTR#conf t
LAB_RTR(config)#! Renumber ACL 110, from line 10... increment in steps of 10
LAB_RTR(config)#ip access-list resequence 110 10 10
LAB_RTR(config)#end
LAB_RTR#

LAB_RTR#sh access-list 110
Extended IP access list 110
    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255
    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18
    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
    50 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120
    60 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
    70 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222
    80 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
    90 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    100 permit udp any any
    110 permit ip any any
LAB_RTR#

Original way to change Cisco IOS ACLs

Originally, the safest way to change your ACL was by removing it from the interfaces in question (this prevented problems if you were changing the ACL via the same interface it was applied to).

Use this technique if your IOS doesn't support IP access-list line numbering:

interface GigabitEthernet0/1.1
 no ip access-group 110 in
!
interface GigabitEthernet0/1.2
 no ip access-group 110 in

Now you can add the new ACL lines, but do it before the other permit any entries...

! Reset the ACL
no access-list 110
!
access-list 110 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
access-list 110 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255
access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18
access-list 110 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
!! New ACL lines before the deny statement
access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120
access-list 110 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222
access-list 110 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
!! Deny statement
access-list 110 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 110 permit udp any any
access-list 110 permit ip any any

Finally, reapply the ACL to the switch...

interface GigabitEthernet0/1.1
 ip access-group 110 in
!
interface GigabitEthernet0/1.2
 ip access-group 110 in

ACL Reorganization

You should really consider using two different ACLs for Gigabit0/1.1 and GigabitEthernet0/1.2... this is a guess at what you're trying to do, but it's unclear that I'm interpreting things correctly...

access-list 111 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44
access-list 111 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255
access-list 111 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255
access-list 111 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255
access-list 111 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
access-list 111 permit udp any any
access-list 111 permit ip any any
!
interface GigabitEthernet0/1.1
 no ip access-group 110 in
 ip access-group 111 in
!
interface GigabitEthernet0/1.2
 no ip access-group 110 in
Improve this answer
6
  • Thanks so much as this has really saved me. This will be added to my printed docs. Really, can you please shed more light into reorganising the ACL? As it seems that will help on the long run.
    – Laredo
    Mar 26, 2014 at 11:26
  • Perhaps we can chat about this tonight, I have to start getting ready for work at the moment. The short summary is try to block all your packets ingress (based on what I see you doing); build each ACL so it only blocks packets sourced from that subnet, and going to others. That's what I tried to do in the ACL reorganization portion of the answer, but I had to make assumptions about your intent... ACL 111 only considers traffic ingress from Gi0/1.1.
    – Mike Pennington
    Mar 26, 2014 at 11:30
  • 1
    That's why it's so nice to have that "Commit" command on XRs or Junipers :)
    – Alex
    Mar 27, 2014 at 6:45
  • 1
    @Alex, fyi... tftp or eem configuration is the closest thing on a cisco... I have used eem to solve some unpleasant situations where I was concerned that I might get locked out, and couldn't use normal config rollback features
    – Mike Pennington
    Mar 27, 2014 at 6:49
  • 1
    You can, and probably should, name ACLs as well.
    – LapTop006
    Mar 27, 2014 at 12:41
0

It likely hangs because upon pasting "the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems."

Helpful Hints for Creating IP Access Lists ¹

•Create the access list before applying it to an interface. An interface with an empty access list applied to it permits all traffic.

•Another reason to configure an access list before applying it is because if you applied a nonexistent access list to an interface and then proceed to configure the access list, the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems.

¹ source Cisco

Improve this answer
-1

ACLs should be tuned in after implementation to save processor cycles. The router has to process each line of an ACL until it gets a match on one of the conditions, or otherwise will always match the implicit 'deny any' at the end of all ACLS. Use a show command to see the hits on each ACL statement. Reorder the statements so that the most hit lines are higher in the ACL. Use notepad to rewrite your ACL.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.