4

I'm trying to find the best way to add comments into my access-lists. For the moment, the only manner I found is the following one:

switch#conf t
switch(config)#ip access-list extended VLAN-TEST3
switch(config-ext-nacl)#remark first remark
switch(config-ext-nacl)#10 permit ip any any
switch(config-ext-nacl)#remark second remark
switch(config-ext-nacl)#20 deny ip any any
switch(config-ext-nacl)#remark third remark

But by using this, I'm unable to see the comments with the command sh ip access-list VLAN-TEST3 they appear only when I do a sh run (which isn't the most practical to see an ACL). I also cannot specify a number of lines for the remark and I can't modify/delete them.

What is the best way to do that? I'm using a Cisco 3750

1
  • It is a bit awkward but you could have 2 telnet sessions side by side ? – fpsO May 15 '14 at 12:07
4

Cisco does not provide any other way see view access lists remarks besides viewing them from the running configuration.

The lines containing remark statements are not numbered so they are ignored when running show ip access-list

You can filter the running config output and display only the section regarding to access-lists like this:

show running-config | section ip access-list
4
  • That's sad, because I can't see the numbers of hits by using this way. Thanks for your answer – Cramix May 14 '14 at 7:33
  • If the ACL is being matched you should see the numbers of hits when using show ip access-lists at the end of the line something like this: (8 matches). Also you could append the log keyword at the end of the access-list entry to display console messages when the access-list is matched – cioby23 May 14 '14 at 7:46
  • 2
    @cioby23, by adding "log" directive to the acl, ios will generate cpu irq on each mathed packet. this can dramatically reduce performance of the device. acl log must be used only in debug purposes – pyatka May 14 '14 at 9:40
  • @cioby23 I know, but my goal was to see matches, comments and line numbers at the same time. – Cramix May 14 '14 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.