ISCW Notes – Access List Resequencing

I don’t know if this really pertains to the ISCW test per se, but this is something I learned in my class last week.  I’m sure I should have learned this years ago, but, alas, I didn’t.

Access lists get messy.   You build one, apply it to an interface, and think all is well.  Then, ask for more access, so you may have to insert new entries between existing lines.  Your security team may ask you to deny access from a host while allowing it from others.  The next thing you know, you ACL looks something like this.

That looks horrible, doesn’t it?  The sequence numbers are all out of whack, and you may run out of head room if you have to insert more lines.  To quickly clean up your ACL, you can run the ip access-list resequence command.

This command will take our example ACL and resequence it starting at 10 and incrementing 10 for each line.  You can start at any number you want (within reason) and increment the same (within reason again).  Using 10 and 10 seems pretty universal, so, once you run that command, your ACL looks like this.

Cool, eh?  I think I’ll spend the week doing this to all our routers at work.

Send any holiday turkeys questions my way.

Aaron Conaway

I shake my head around sometimes and see what falls out. That's what lands on these pages.

More Posts

Follow Me:
Twitter

4 comments for “ISCW Notes – Access List Resequencing

  1. Tom
    November 12, 2009 at 9:31 am

    One other note when using the resequencing – it can sometimes mess up the positioning of ACL remarks. With long ACLs, this can be a headache. It is a great option, though.

  2. December 25, 2009 at 11:30 pm

    Right on. Thanks.

  3. December 28, 2009 at 11:25 am

    this is the cisco page with all the options:
    http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fsaclseq.html

Leave a Reply

Your email address will not be published. Required fields are marked *