Editing Cisco ACLs Inline

Are you annoyed at having to copy an ACL to a text editor to add a line?   After that, you have to either remove the ACL entirely or add the new version with a different name and update all the interfaces to use the new name.  I have been using the following trick recently to edit ACLs inline without having the complete remove or rewrite the ACL.

Suppose you have the following ACL which was being used in conjunction to IOS firewall (I will not detail IOS Firewall at this time).

You find out that you now need to add a public webserver located at 192.0.2.80.  You also need to block an abusive network in another country(198.51.100.0/24) from hitting your site at all.  You can use the following trick to edit the ACL inline.

First do a show ip access-lists to see the auto-assigned line numbers.


Router#show access-lists wan-in
Extended IP access list wan-in
    10 permit icmp any any echo
    20 permit icmp any any echo-reply
    30 permit icmp any any unreachable
    40 permit icmp any any time-exceeded
    50 permit tcp any any eq 443
    60 permit tcp any any eq 22
    70 deny ip any any


Next we will add the two rules in the places we want to add them.  In this case the block rule needs to be first, and the www rule needs to come before the last deny line.


Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#ip access-list extended wan-in
Router(config-ext-nacl)#5 deny ip 198.51.100.0 0.0.0.255 any
Router(config-ext-nacl)#65 permit tcp any any eq www


Then last we verify our changes checking both the running config and the show command.


Router#show ip access-lists wan-in
Extended IP access list wan-in
    5 deny ip 198.51.100.0 0.0.0.255 any
    10 permit icmp any any echo
    20 permit icmp any any echo-reply
    30 permit icmp any any unreachable
    40 permit icmp any any time-exceeded
    50 permit tcp any any eq 443
    60 permit tcp any any eq 22
    65 permit tcp any any eq www
    70 deny ip any any
Router#show running-config
...
!
ip access-list extended wan-in
 deny   ip 198.51.100.0 0.0.0.255 any
 permit icmp any any echo
 permit icmp any any echo-reply
 permit icmp any any unreachable
 permit icmp any any time-exceeded
 permit tcp any any eq 443
 permit tcp any any eq 22
 permit tcp any any eq www
 deny   ip any any
!
...