10 permit tcp 10.30.133.27 0.0.0.0 eq 23 0.0.0.0 255.255.255.255
IPv4 Access Control Lists (ACLs)
Creating or Editing ACLs Offline
If you are replacing an ACL on the switch with a new ACL that uses the
same number or name syntax, begin the command file with a no ip access-
list command to remove the earlier version of the ACL from the switch’s
running-config file. Otherwise, the switch will append the new ACEs in
the ACL you download to the existing ACL. For example, if you planned
to use the copy command to replace ACL “List-120”, you would place this
command at the beginning of the edited file:
no ip access-list extended List-120
no ip access-list extended List-120
Removes an existing ACL
ip access-list extended "List-120"
and replaces it with a
10 remark "THIS ACE ALLOWS TELNET"
new version with the
same identity. To append
20 deny ip 10.30.133.1 0.0.0.255 0.0.0.0 255.255.255.255
new ACEs to an existing
ACL instead of replacing
30 deny ip 10.30.155.1 0.0.0.255 0.0.0.0 255.255.255.255
it, you would omit the first
40 remark "THIS IS THE FINAL ACE IN THE LIST"
line and ensure that the
40 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
sequence numbering for
exit
the new ACEs begin with
a number greater than
the highest number in the
existing list.
Figure 9-32. Example of an Offline ACL File Designed To Replace An Existing ACL
3. Use copy tftp command-file to download the file as a list of commands to
the switch.
4. Use the show run or show access-list config command to inspect the switch
configuration to ensure that the ACL was properly downloaded.
Note If a transport error occurs, the switch does not execute the command and the
ACL is not configured.
9-95
