Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have extended access-list BLOCK, where each entire has its own special number. EX:

1038047 deny ip any host 192.168.38.47
1038048 deny ip any host 192.168.38.48
1038049 deny ip any host 192.168.38.49
1038069 deny ip any host 192.168.38.69
1038077 deny ip any host 192.168.38.77
1038080 deny ip any host 192.168.38.80

Formula is 1 000 000 + 1 000*3_octet+4_octet , and the last one is

3 000 000 permit ip any any

But after reboot they become:

2020 deny ip any host 192.168.38.27
2030 deny ip any host 192.168.38.32
2040 deny ip any host 192.168.38.37
2050 deny ip any host 192.168.38.38
2060 deny ip any host 192.168.38.43

It is bad. Is there any command to prohibit cisco resequencing entires?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

According to Cisco, the maximum valid sequence number in an IOS access list is 2147483647. Can you confirm what platform/code version you are running?

In terms of persistence across reboots, as mentioned by Jeb, sequence numbers are not stored in the configuration file. (do a 'show startup-config' to verify this) I don't think this is a bug, simply a known limitation.

What is the requirement for having your specific sequence numbers? In newer versions of IOS, there is always an implicit 'deny any any' at the end of any non-empty access list. Unless you are inputting a 'deny any log' so that you can log unauthorised traffic to syslog, you can simply append to your existing ACL, and the implicit deny will always be at the end?

EDIT:

I don't believe there's a way to change the implicit deny behaviour. One solution might be to store your configuration (including sequence numbers) remotely, and then to delete and recreate the entire ACL when you make changes? Unfortunately, Cisco's ACL implementation is designed around the, 'permit what you need, deny the rest' approach.

One way around the issue, assuming you are running a recent enough code version, might be to use Object Group-Based ACLs. You could then have a policy as follows.

Note: hand cut config; ensure you test before you deploy!

object-group network denied-destination-hosts
 host 192.168.38.27
 host 192.168.38.32
 host 192.168.38.37
 host 192.168.38.38
 host 192.168.38.43
!

ip access-list extended BLOCK
 deny ip any object-group denied-destination-hosts
 permit ip any any
!

This would then allow you to modify the list of denied hosts independently of the 'BLOCK' ACL, and would ensure that your 'permit' statement was always the last entry.

share|improve this answer
    
but if i need to have last rule "permit ip any any"? –  TiFFolk Jun 15 '09 at 21:07
    
thanx! That is very interesting. Anyway, 3750 does not support this at all, but the solution is what i was dreaming of) –  TiFFolk Jun 15 '09 at 22:27
    
SNMP interface indexes are not in the config either and they can be persistent if so configured. So it doesn't have to be in the config. –  Thomas Jun 30 '09 at 18:16

I might be wrong but I don't think you can use ACL numbers that high, the actual list numbers are defined by their type, i.e IP ACLs must be between certain ranges, extended IP another range etc. (see HERE for details).

share|improve this answer
1  
He's not using numbered ACLs; he's using high sequence numbers within a single named ACL. –  Murali Suriar Jun 15 '09 at 16:41

I think that you just can't because the numbers are not stored in the configuration file. This is just intended to be used to be able to insert a line where you want in the ACL. And for Chopper3 (I can't yet add comment), here is talking about ACL line ordering, not ACL numbers as describe in the link you given.

share|improve this answer
    
ok, cool, thanks. –  Chopper3 Jun 15 '09 at 10:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.