I want to add new ACL rules to a Cisco router. I have no previous experience with cisco.

Many resources about Cisco acls have instructions on applying the acl rules to an interface. But I need to know which ACL rule is already active in an interface, so that I can add new rules to it.

show interfaces command does not display the ACLs, which command is used to get the ACLs on an interface?

Edit: this page states show ip access-list interface tunnel 0 command for displaying ACLs on an interface, but it is usable only on IOS 12.4 and newer. What are my options in an IOS 11.1 router?

Solution: The issue is solved, but I don't know how :) I was told that somebody else™ fixed the issue.


In trying to learn the current configuration on pretty much any Cisco device, show run is normally a good starting point.

Once you have extracted the portion of the running configuration that partains to the list your targeting, you can start to figure out what you need to add, remove, or change.

If you looking for a simple solution to edit an ACL I highly recommend Garth Evens ACL Editor. It not only will parse out the ACL so it is easy to read, you can also simulate what the ACL will do.


show run will display the active configuration, including ACLs.


There's no command to do this in one go. You'll need to show run <interface name> to get the ACL applying and then show access-list <whatever> to see the actual rules.

  • Chris is correct, but also remember, not all access lists in a box are strictly used to block traffic on an interface, you can also have an access list control traffic into a QOS policy map, or if traffic can be NAT'd, or if an IP is allowed to telnet to the cisco. – Lloyd Baker Aug 30 '10 at 16:22

The "proper" way to do this without show run is 'show ip int X/Y'. This will show you all ip related information pertaining to an interface.

TenGigabitEthernet3/5 is up, line protocol is up
  Internet address is
  Broadcast address is
  Address determined by setup command
  MTU is 4470 bytes
  Helper address is not set
  Directed broadcast forwarding is disabled
  Outgoing access list is not set
  Inbound  access list is not set

If there was an ACL set, it would tell you right here and then you could look at show access-list to look at the actual contents of it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.