Creating or editing an ACL offline

The section titled Editing an existing ACL describes how to use the CLI to edit an ACL, and is most applicable in cases where the ACL is short or there is only a minor editing task to perform. The offline method provides an alternative to using the CLI for creating or extensively editing a large ACL. This section describes how to:

Procedure
  1. move an existing ACL to a TFTP server
  2. use a text (.txt) file format to create a new ACL or edit an existing ACL offline
  3. use TFTP to load an offline ACL into the switch’s running-config

For longer ACLs that may be difficult or time-consuming to accurately create or edit in the CLI, you can use the offline method described in this section.

NOTE:

The

copy

commands that used either

tftp

,

sftp

, or

xmodem

. So although the following example highlights tftp, bear in mind that

sftp

or

xmodem

can also be used to transfer ACLs to and from the switch.

  • Begin by doing one of the following:
    • To edit one or more existing ACLs, use

    • To create a new ACL, just open a text (.txt) file in the appropriate directory on a TFTP server accessible to the switch.

  • Use a text editor to create or edit the ACL(s) in the *.txt ASCII file format.

  • If you are replacing an ACL on the switch with a new ACL that uses the same number or name syntax, begin the command file with a no ip access-list command to remove the earlier version of the ACL from the switch running-config file. Otherwise, the switch will append the new ACEs in the ACL you download to the existing ACL.

  • For example, if you planned to use the copy command to replace ACL "List-120", place this command at the beginning of the edited file: 
    no ip access-list extended List-120
    An offline ACL file designed to replace an existing ACL

  • Use copy tftp command-file to download the file as a list of commands to the switch.

  • The command to assign the ACL to a VLAN was included in the .txt command file. If this is not done in your applications, then the next step is to manually assign the new ACL to the intended VLAN.

  • You can then use the show run or show access-list config command to inspect the switch configuration to ensure that the ACL was properly downloaded.
    Example of verifying the .txt file download to the switch
  • If the configuration appears satisfactory, save it to the startup-config file: 
    switch(config)# write memory