Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently started taking on more network management tasks to help our short staffed networking team. I'm very comfortable with network theory and have configured an number of IOS devices, but am hardly a IOS guru.

One of the first large tasks I was assigned was to add some ACL rules to a hundred plus ACLs we have. Coming from the sys admin side of things, I was baffled to find out that these changes are all made by hand.

Is there not a way to automate these types of configuration issues? What tools should I be learning to use for changing configurations in a scripted fashion across many devices/ACLs? So far my Googlefu has only pointed to Python with pexpect. Just seems like this is such a common task that there would be better tools already setup for it.

I understand that this could be a fairly broad question, but I'm just looking for a starting place to work from.

Note: If there is a commercial tool that is a perfect fit for this case, just assume that we didn't pay for it. That is normally how it goes.

share|improve this question
Here are some more details. I'm not looking to push the same rule out to a bunch of identical ACLs on many devices. I'm looking to modify vlan ACLs to add a rule to many different ACLs such as "permit <subnet ips> <server> eq <port>". – lmickh Aug 6 '12 at 19:33

On the commercial side there's Cisco Security Manager that can handle ACL's on IOS boxes, ASA, etc. There's a 90 day free eval and it runs in a VM. That might be worth looking at. There's also fwbuilder that offers multi-platform ACL management (including IOS), but I haven't spent much time with it.

share|improve this answer
I'm actually looking to modify ACLs assigned to vlans, but I'll take a look at those and see if they would work. – lmickh Aug 6 '12 at 19:30
I had assumed you were talking about security but realize I could be mistaken. Are you talking about VACL's or QoS marking or something along similar lines? – rnxrx Aug 6 '12 at 19:59
Extended IP ACLs applied to the vlans via "ip access-group aclname in". – lmickh Aug 6 '12 at 20:17
So a standard ACL - CSM and similar would work fine for this... no different than an IOS ACL on anything else. – rnxrx Aug 6 '12 at 20:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.