How to Edit an ACL

[fenstrat]

I have the following Access lists, It's been awhile for me and our network admin is gone. I need to edit this list to allow 172.25.104.* through the router.

#show access-lists
Standard IP access list 1
permit 172.25.10.13 (3886342 matches) check=21
permit 172.25.10.12 (6381588 matches) check=77331
permit 172.25.10.10 (109487023 matches) check=1533201
permit 172.25.100.1 (288790 matches) check=479072
Standard IP access list 2
permit 172.25.98.0, wildcard bits 0.0.0.255 (797748550 matches) check=73394
588
permit 172.25.99.0, wildcard bits 0.0.0.255 (733942588 matches)
Extended IP access list 100
permit ip 172.25.98.0 0.0.0.255 any (1638264527 matches)
permit ip 172.25.99.0 0.0.0.255 any (1500265580 matches)
permit ip host 172.25.10.10 any (220266618 matches)
permit ip host 172.25.10.12 any (12923476 matches)
permit ip host 172.25.10.13 any (7846441 matches)
permit ip host 172.25.100.1 any (608207 matches)
charybdis#

 

[lgarner]

Either "access-list 1 permit 172.25.104.0 0.0.0.255" (or same with access-list 2)

or "access-list 100 permit ip 172.25.104.0 0.0.0.255 any"

It depends on which access list is applied to the interface nearest 172.25.104.0.

 

[chieftan999]

Dont forget, if you edit this on the actual router, it will add the entry to the top of the access-list.

Before you remove the access list from the router MAKE SURE you remove the access group from the interfaces or you will have big problems.

Think about where you need to add the entry and then you will need to copy the access list into notepad (or other text editing apllication). Add the entry into the list. Remove the access group (pertaining to the access list) from the Interface it is applied to. Then, remove the access-list. Copy the updated access list from notepad back to the telnet session windows and apply.

You have now updated your access list. Remember to re apply the access group to the required interfaces.

 

[ChrisAC]

Dont forget, if you edit this on the actual router, it will add the entry to the top of the access-list."

It will add the entery to the bottom.

evilhomer#conf t
Enter configuration commands, one per line. End with CNTL/Z.
evilhomer(config)#access-list 101 permit ip any any
evilhomer(config)#^Z
evilhomer#sh access-list 101
Extended IP access list 101
10 permit ip any any
evilhomer#conf t
Enter configuration commands, one per line. End with CNTL/Z.
evilhomer(config)#access-list 101 deny ip any any log
evilhomer(config)#^Z
evilhomer#sh access-list 101
Extended IP access list 101
10 permit ip any any
20 deny ip any any log

Chris.

**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[chieftan999]

Apologies IProute - you are quite correct.

For full ACL editing see this cisco site:-

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml