The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Users can apply sequence numbers to permit or deny statements and also reorder, add, or remove such statements from a named IP access list. This feature makes revising IP access lists much easier. Prior to this feature, users could add access list entries to the end of an access list only; therefore needing to add statements anywhere except the end required reconfiguring the access list entirely.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Access lists perform packet filtering to control which packets move through the network and where. Such control can help limit network traffic and restrict the access of users and devices to the network. Access lists have many uses, and therefore many commands accept a reference to an access list in their command syntax. Access lists can be used to do the following:
An access list is a sequential list consisting of a permit statement and a deny statement that apply to IP addresses and possibly upper-layer IP protocols. The access list has a name by which it is referenced. Many software commands accept an access list as part of their syntax.
An access list can be configured and named, but it is not in effect until the access list is referenced by a command that accepts an access list. Multiple commands can reference the same access list. An access list can control traffic arriving at the router or leaving the router, but not traffic originating at the router.
Source address and destination addresses are two of the most typical fields in an IP packet on which to base an access list. Specify source addresses to control packets from certain networking devices or hosts. Specify destination addresses to control packets being sent to certain networking devices or hosts.
Address filtering uses wildcard masking to indicate to the software whether to check or ignore corresponding IP address bits when comparing the address bits in an access list entry to a packet being submitted to the access list. By carefully setting wildcard masks, an administrator can select single or several IP addresses for permit or deny tests.
Wildcard masking for IP address bits uses the number 1 and the number 0 to specify how the software treats the corresponding IP address bits. A wildcard mask is sometimes referred to as an inverted mask because a 1 and 0 mean the opposite of what they mean in a subnet (network) mask.
If you do not supply a wildcard mask with a source or destination address in an access list statement, the software assumes a default wildcard mask of 0.0.0.0.
Unlike subnet masks, which require contiguous bits indicating network and subnet to be ones, wildcard masks allow noncontiguous bits in the mask.
You can filter packets based on transport layer information, such as whether the packet is a TCP, UDP, ICMP or IGMP packet.
The ability to apply sequence numbers to IP access list entries simplifies access list changes. Prior to the IP Access List Entry Sequence Numbering feature, there was no way to specify the position of an entry within an access list. If a user wanted to insert an entry (statement) in the middle of an existing list, all of the entries after the desired position had to be removed, then the new entry was added, and then all the removed entries had to be reentered. This method was cumbersome and error prone.
This feature allows users to add sequence numbers to access list entries and resequence them. When a user adds a new entry, the user chooses the sequence number so that it is in a desired position in the access list. If necessary, entries currently in the access list can be resequenced to create room to insert the new entry.
Exceeded maximum sequence number.
Duplicate sequence number.
This task shows how to assign sequence numbers to entries in a named IP access list and how to add or delete an entry to or from an access list. It is assumed a user wants to revise an access list. The context of this task is the following:
Review the output of the show ip access-lists command to see that the access list includes the new entries:
Router# show ip access-lists kmd1
Standard IP access list kmd1
100 permit 10.4.4.0, wildcard bits 0.0.0.255
105 permit 10.5.5.0, wildcard bits 0.0.0.255
115 permit 10.0.0.0, wildcard bits 0.0.0.255
130 permit 10.5.5.0, wildcard bits 0.0.0.255
145 permit 10.0.0.0, wildcard bits 0.0.0.255
The following example shows access list resequencing. The starting value is 1, and increment value is 2. The subsequent entries are ordered based on the increment values that users provide, and the range is from 1 to 2147483647.
When an entry with no sequence number is entered, by default it has a sequence number of 10 more than the last entry in the access list.
Router# show access-list 150 Extended IP access list 150 10 permit ip host 10.3.3.3 host 172.16.5.34 20 permit icmp any any 30 permit tcp any host 10.3.3.3 40 permit ip host 10.4.4.4 any 50 Dynamic test permit ip any any 60 permit ip host 172.16.2.2 host 10.3.3.12 70 permit ip host 10.3.3.3 any log 80 permit tcp host 10.3.3.3 host 10.1.2.2 90 permit ip host 10.3.3.3 any 100 permit ip any any Router(config)# ip access-list extended 150 Router(config)# ip access-list resequence 150 1 2 Router(config)# end Router# show access-list 150 Extended IP access list 150 1 permit ip host 10.3.3.3 host 172.16.5.34 3 permit icmp any any 5 permit tcp any host 10.3.3.3 7 permit ip host 10.4.4.4 any 9 Dynamic test permit ip any any 11 permit ip host 172.16.2.2 host 10.3.3.12 13 permit ip host 10.3.3.3 any log 15 permit tcp host 10.3.3.3 host 10.1.2.2 17 permit ip host 10.3.3.3 any 19 permit ip any any
In the following example, an new entry is added to a specified access list:
Router# show ip access-list Standard IP access list tryon 2 permit 10.4.4.2, wildcard bits 0.0.255.255 5 permit 10.0.0.44, wildcard bits 0.0.0.255 10 permit 10.0.0.1, wildcard bits 0.0.0.255 20 permit 10.0.0.2, wildcard bits 0.0.0.255 Router(config)# ip access-list standard tryon Router(config-std-nacl)# 15 permit 10.5.5.5 0.0.0.255 Router# show ip access-list Standard IP access list tryon 2 permit 10.4.0.0, wildcard bits 0.0.255.255 5 permit 10.0.0.0, wildcard bits 0.0.0.255 10 permit 10.0.0.0, wildcard bits 0.0.0.255 15 permit 10.5.5.0, wildcard bits 0.0.0.255 20 permit 10.0.0.0, wildcard bits 0.0.0.255
The following example shows how an entry with no specified sequence number is added to the end of an access list. When an entry is added without a sequence number, it is automatically given a sequence number that puts it at the end of the access list. Because the default increment is 10, the entry will have a sequence number 10 higher than the last entry in the existing access list.
Router(config)# ip access-list standard 1 Router(config-std-nacl)# permit 10.1.1.1 0.0.0.255 Router(config-std-nacl)# permit 10.2.2.2 0.0.0.255 Router(config-std-nacl)# permit 10.3.3.3 0.0.0.255 Router# show access-list Standard IP access list 1 10 permit 0.0.0.0, wildcard bits 0.0.0.255 20 permit 0.0.0.0, wildcard bits 0.0.0.255 30 permit 0.0.0.0, wildcard bits 0.0.0.255 Router(config)# ip access-list standard 1 Router(config-std-nacl)# permit 10.4.4.4 0.0.0.255 Router(config-std-nacl)# end Router# show access-list Standard IP access list 1 10 permit 0.0.0.0, wildcard bits 0.0.0.255 20 permit 0.0.0.0, wildcard bits 0.0.0.255 30 permit 0.0.0.0, wildcard bits 0.0.0.255 40 permit 0.0.0.0, wildcard bits 0.0.0.255
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
IP access list commands |
Cisco IOS Security Command Reference |
Configuring IP access lists |
"Creating an IP Access List and Applying It to an Interface" |
Standards |
Title |
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
-- |
MIBs |
MIBs Link |
---|---|
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs |
Title |
---|---|
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature. |
-- |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 | Feature Information for IP Access List Entry Sequence Numbering |
Feature Name |
Releases |
Feature Information |
---|---|---|
IP Access List Entry Sequence Numbering |
Cisco IOS XE Release 2.1 |
This feature was introduced on the Cisco ASR 1000 Aggregation Services Series Routers. The following commands were introduced or modified: ip access-list resequence, deny (IP), permit (IP). |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.