Home / server / Questions / 175621
Accepted
hayalci
Asked: 2010-08-29 05:02:25 +0800 CST

How to learn current ACLs on a Cisco router's interface

  • 772

I want to add new ACL rules to a Cisco router. I have no previous experience with cisco.

Many resources about Cisco acls have instructions on applying the acl rules to an interface. But I need to know which ACL rule is already active in an interface, so that I can add new rules to it.

show interfaces command does not display the ACLs, which command is used to get the ACLs on an interface?

Edit: this page states show ip access-list interface tunnel 0 command for displaying ACLs on an interface, but it is usable only on IOS 12.4 and newer. What are my options in an IOS 11.1 router?

Solution: The issue is solved, but I don't know how :) I was told that somebody else™ fixed the issue.

cisco access-control-list

4 Answers

  1. show run will display the active configuration, including ACLs.

    • 4

  2. There's no command to do this in one go. You'll need to show run <interface name> to get the ACL applying and then show access-list <whatever> to see the actual rules.

    • 2
  3. Best Answer

    In trying to learn the current configuration on pretty much any Cisco device, show run is normally a good starting point.

    Once you have extracted the portion of the running configuration that partains to the list your targeting, you can start to figure out what you need to add, remove, or change.

    If you looking for a simple solution to edit an ACL I highly recommend Garth Evens ACL Editor. It not only will parse out the ACL so it is easy to read, you can also simulate what the ACL will do.

    • 1

  4. The "proper" way to do this without show run is 'show ip int X/Y'. This will show you all ip related information pertaining to an interface.

    TenGigabitEthernet3/5 is up, line protocol is up
  Internet address is 10.10.10.1/30
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 4470 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set

    If there was an ACL set, it would tell you right here and then you could look at show access-list to look at the actual contents of it.

    • 0