ISCW Notes – Access List Resequencing
I don’t know if this really pertains to the ISCW test per se, but this is something I learned in my class last week. I’m sure I should have learned this years ago, but, alas, I didn’t.
Access lists get messy. You build one, apply it to an interface, and think all is well. Then, ask for more access, so you may have to insert new entries between existing lines. Your security team may ask you to deny access from a host while allowing it from others. The next thing you know, you ACL looks something like this.
Router#sh access-lists Extended IP access list MyACL 5 deny tcp host 192.168.0.38 any eq www 6 deny tcp host 192.168.0.39 any eq www 10 permit tcp 192.168.0.0 0.0.0.255 any eq www 15 deny tcp host 192.168.0.39 any eq 443 17 deny tcp host 192.168.0.85 any eq 443 20 permit tcp 192.168.0.0 0.0.0.255 any eq 443 30 deny ip any any log
That looks horrible, doesn’t it? The sequence numbers are all out of whack, and you may run out of head room if you have to insert more lines. To quickly clean up your ACL, you can run the ip access-list resequence command.
Router(config)#ip access-list resequence MyACL 10 10
This command will take our example ACL and resequence it starting at 10 and incrementing 10 for each line. You can start at any number you want (within reason) and increment the same (within reason again). Using 10 and 10 seems pretty universal, so, once you run that command, your ACL looks like this.
Router#sh access-list Extended IP access list MyACL 10 deny tcp host 192.168.0.38 any eq www 20 deny tcp host 192.168.0.39 any eq www 30 permit tcp 192.168.0.0 0.0.0.255 any eq www 40 deny tcp host 192.168.0.39 any eq 443 50 deny tcp host 192.168.0.85 any eq 443 60 permit tcp 192.168.0.0 0.0.0.255 any eq 443 70 deny ip any any log
Cool, eh? I think I’ll spend the week doing this to all our routers at work.
Send any holiday turkeys questions my way.
https://masto.ai/@aconaway
- Generating Network Diagrams from Netbox with Pynetbox - August 23, 2023
- Out-of-band Management – Useful Beyond Catastrophe - July 13, 2023
- Overlay Management - July 12, 2023
[…] Aaron’s Worthless Words » Blog Archive » ISCS Notes – Access List Resequencing –This is why I read blogs. It helps to learn things that you don’t otherwise find out about. Aaaron talks about the ACL renumbering with an IOS CLI trick. […]
One other note when using the resequencing – it can sometimes mess up the positioning of ACL remarks. With long ACLs, this can be a headache. It is a great option, though.
Right on. Thanks.
this is the cisco page with all the options:
http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fsaclseq.html