IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Inline ACL action modifications

Updated: August 12, 2026

Want to summarize with AI?

Log in

This topic explains how supported Cisco 8000 Series Routers update ACL actions without repositioning hardware entries and describes update behavior, forwarding continuity, scope, restrictions, and verification.

An inline access control list (ACL) action modification is a hardware update method that:

  • Changes supported action fields on an existing access control entry without creating or deleting that entry.

  • Preserves the programmed match fields and avoids hardware entry repositioning.

  • Keeps the entry present in hardware while the action changes.

Feature History Table

Table 1. Feature History Table
Feature name Release information Feature description

Inline ACL action modifications

 Release 26.3.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100]; 8700 [ASIC: K100, P100], 8200 [ASIC: P100]); Modular Systems (8800) (select variants only*)

Adds inline hardware updates for supported action-only changes to existing ACL entries. Match-field changes continue to use the existing hardware update method.

The update method is selected automatically and does not add a configuration command.

*This feature is supported on:

  • 8011-4G24Y4H-I

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

  • 8712-MOD-M

  • 8711-48Z-M

  • 8212-48FH-M

  • 8711-32FH-M

  • 8223-64EF-M(O)

Line cards:

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Key characteristics of inline ACL action modifications

  • The router selects the update method automatically. An action-only change uses the inline method.

  • A match-field change or a change that includes match fields uses the existing hardware update method.

  • The inline method applies to supported action changes such as permit or deny, policer settings, and Differentiated Services Code Point (DSCP) remarking.

  • The action change does not require a different ACL configuration.

ACL update behavior

This table compares action-only changes with changes that include match fields.

Table 2. ACL update methods

Change type

Hardware update

Forwarding behavior

Action-only change

Updates the supported action fields on the existing hardware entry without repositioning the entry.

Keeps the access control entry present while the action changes.

Match-field change or combined match-field and action change

Uses the existing hardware update method.

Preserves the existing behavior for match-field updates.

Verify inline ACL action modifications

Use these checks after you commit an action-only change to an existing ACL entry. The commands use IPv4 syntax. For an IPv6 ACL, replace the ipv4 keyword with ipv6 .

Before you begin, identify the ACL name and the node where the ACL is programmed.

Procedure

  1. Display detailed ingress hardware information for the ACL.

    Example:

    Router# show access-lists ipv4 <acl-name> hardware ingress detail location <node-id>

    Confirm that the modified access control entry shows the expected action.

  2. Verify the ingress hardware programming for the ACL.

    Example:

    Router# show access-lists ipv4 <acl-name> hardware ingress verify location <node-id>

    Confirm that the verification completes without a hardware programming error.

    The hardware entry displays the updated action, and the hardware verification completes without an error.