Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if there is any Cisco product that supports import of external list with IP ranges to be blocked or allowed.

CIRD format:

# List distributed by ...

The updates would be daily.

share|improve this question
up vote 2 down vote accepted

In what form would this list be supplied, and how often would you want to update it? You could set up a cron job that copies over an access-list on a daily basis, or you could set up a BGP peer with a quagga server to feed it a list of routes, but you're not likely to find a button that says 'block these IPs'.

share|improve this answer
You would have to write this yourself - in a general sense, put the file into a location on a server, run some perl or whatever to change it into access-list format, then use a cron job to copy that list to the router on a daily basis. Oh, and remember to be sure to error-check that list before you copy it, you wouldn't want to accidentally put a block in, would you? – Aaron Dec 1 '11 at 19:54
updating the acl commands is easy - int X/Y, no access-list 101 in, no access-list 101, copy rcp:// running-config, int x/y, access-list 101 in – Aaron Dec 1 '11 at 20:01

Based on on @Aaron's answered this is what I came up with:

conf t
int f0/0
no ip access-group 101 in
no access-list 101
copy running-config 
conf t
int f0/0
ip access-group 101 in
conf t 
service compress-config 
wri mem 

And here is how you can use kron:

And here is little java hint on how do the conversion:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.