IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Modify ACLs

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic describes how to modify existing access control lists (ACLs) on the Cisco 8000 Series Router by adding, deleting, and updating access control entries (ACEs).

This section describes a sample configuration for modification of ACLs.

Note

While ACLs allow configuration without sequence numbers, use sequence numbers when adding or deleting ACL entries. In classic ACLs, sequence numbers help minimize backend changes and make it easier for users to track modifications. By specifying sequence numbers, users can add or remove specific entries without affecting other ACEs in hardware. The ACL's appearance remains unchanged except for the intended updates.

Procedure

  1. Create an access list and add entries (ACEs) to it.

    Example:

    /* Create an access list */
Router(config)# ipv4 access-list acl_1

/* Add entries (ACEs) to the ACL */
Router(config-ipv4-acl)# 10 permit ip host 10.3.3.3 host 172.16.5.34
Router(config-ipv4-acl)# 20 permit icmp any any
Router(config-ipv4-acl)# 30 permit tcp any host 10.3.3.3
Router(config-ipv4-acl)# end

/* Verify the entries of the ACL */
Router# show access-lists ipv4 acl_1
ipv4 access-list acl_1
 10 permit ip host 10.3.3.3 host 172.16.5.34
 20 permit icmp any any
 30 permit tcp any host 10.3.3.3

  2. Add a new entry with sequence number "15" to the ACL, and delete the entry with sequence number "30".

    Example:

    Router(config)# ipv4 access-list acl_1
Router(config-ipv4-acl)# 15 permit 10.5.5.5 0.0.0.255
Router(config-ipv4-acl)# no 30
Router(config-ipv4-acl)# permit 10.4.4.4 0.0.0.255
Router(config-ipv4-acl)# commit

/* Verify the entries of the ACL */
Router# show access-lists ipv4 acl_1
ipv4 access-list acl_1
 10 permit ipv4 host 10.3.3.3 host 172.16.5.34
 15 permit 10.5.5.5 0.0.0.255      /* newly added ACE (with the sequence number) */
 20 permit icmp any any
 30 permit ipv4 10.4.4.0 0.0.0.255 any    /* newly added ACE (without the sequence number) */

    The entry with the sequence number 30, that is, "30 permit tcp any host 10.3.3.3" is deleted from the ACL.

  3. Add another entry without a sequence number to the ACL.

    Example:

    Router(config)# ipv4 access-list acl_1
Router(config-ipv4-acl)# permit 10.4.4.4 0.0.0.255
Router(config-ipv4-acl)# commit

/* Verify the entries of the ACL */
Router# show access-lists ipv4 acl_1
ipv4 access-list acl_1
 10 permit ipv4 host 10.3.3.3 host 172.16.5.34
 15 permit 10.5.5.5 0.0.0.255
 20 permit icmp any any
 30 permit ipv4 10.4.4.0 0.0.0.255    /* newly added ACE (without the sequence number) */

    When an entry is added without a sequence number, it is automatically given a sequence number that puts it at the end of the access list. Because the default increment is 10, the entry has a sequence number 10 higher than the last entry in the existing access list.

  4. Modify an existing entry in the ACL using the sequence number.

    Example:

    Router(config)# ipv4 access-list acl_1
Router(config-ipv4-acl)# 10 permit 10.2.1.1 0.0.255.255
Router(config-ipv4-acl)# commit

/* Verify the entries of the ACL */
Router# show access-lists ipv4 acl_1
ipv4 access-list acl_1
 10 permit 10.2.1.1 0.0.255.255      /* Modified ACL entry */
 15 permit 10.5.5.5 0.0.0.255
 20 permit icmp any any
 30 permit ipv4 10.4.4.0 0.0.0.255

    You have successfully modified ACLs in operation.