Viewing ACL configuration data

The show commands in this section apply to both IPv4 and IPv6 ACLs. For information on IPv6 ACL operation, see the chapter titled “IPv6 Access Control Lists” in the IPv6 Configuration Guide for your switch.

Viewing an ACL summary

This command lists the configured IPv4 and IPv6 ACLs, regardless of whether they are assigned to any VLANs.

Syntax:

show access-list

List a summary table of the name, type, and application status of IPv4 and IPv6 ACLs configured on the switch.

Summary table of access list

Term	Meaning
Type	Shows whether the listed ACL is an IPv4 `std` ACL, an IPv4 `ext`ACL, or an IPv6 ACL.
Appl	Shows whether the listed ACL has been applied to an interface (`yes`/`no`).
Name	Shows the identifier (name or number) assigned to each ACL configured in the switch.

Viewing the content of all ACLs on the switch

This command lists the configuration details for the IPv4 and IPv6 ACLs in the running-config file, regardless of whether any are actually assigned to filter IPv4 traffic on specific VLANs.

Syntax:

show access-list config

List the configured syntax for all IPv4 and IPv6 ACLs currently configured on the switch.

NOTE: Notice that you can use the output from this command for input to an offline text file in which you can edit, add, or delete ACL commands.

This information also appears in the show running display. If you executed write memory after configuring an ACL, it appears in the show config display.

An ACL configured syntax listing shows the ACLs on a switch configured with two IPv6 ACLs named "Accounting" and "List-01-Inbound", and one extended IPv4 ACL named "101":

An ACL configured syntax listing

Switch(config)# show access-list config
ip access-list extended "101"
   10 permit tcp 10.30.133.27 0.0.0.0 0.0.0.0 255.255.255.255
   20 permit tcp 10.30.155.101 0.0.0.0 0.0.0.0 255.255.255.255
   30 deny ip 10.30.133.1 0.0.0.0 0.0.0.0 255.255.255.255 log
   40 deny ip 10.30.155.1 0.0.0.255 0.0.0.0 255.255.255.255
   exit
ipv6 access-list "Accounting"
     10 permit tcp 2001:db8:0:1af::10:14/128 ::/0 eq 23
     20 permit tcp 2001:db8:0:1af::10:23/128 ::/0 eq 23
     30 deny tcp 2001:db8:0:1af::10/116 ::/0 log
     40 permit ipv6 2001:db8:0:1af::10/116 ::/0
     50 deny ipv6 ::/0 ::/0 log
   exit
ipv6 access-list "List-01-Inbound"
     10 permit icmp fe80::10:60/128 ::/0 dscp 38
     20 permit icmp fe80::10:77/128 ::/0 dscp 38
     30 permit icmp fe80::10:83/128 ::/0 dscp 38
     40 deny icmp ::/0 ::/0 dscp 38
     50 permit ipv6 fe80::10/112 ::/0
     60 deny ipv6 fe80::/64 ::/0
   exit

Viewing the VACL assignments for a VLAN

This command briefly lists the identification andtypes of IPv4 and IPv6 VACLs currently assigned to a particular VLAN in the running-config file.

Syntax:

show access-list vlan <vid>

Lists the current IPv4 and IPv6 ACL assignments to the specified VLAN (in the running config file).


	NOTE: This information also appears in the `show running` display. If you execute `write memory` after configuring an ACL, it also appears in the `show config` display.

Example:

The following output shows that all inbound IPv6 traffic and the inbound and outbound, routed IPv4 traffic are all filtered on VLAN 20.

Listing the ACL assignments for a VLAN

Viewing static port (and trunk) ACL assignments

This command lists the identification and types of current static port ACL assignments to individual switch ports and trunks, as configured in the running-config file. The switch allows one static port ACL assignment per port.

Syntax:

show access-list ports <all|port-list>

Lists the current static port ACL assignments for ports and trunks in the running config file.


	NOTE: This information also appears in the `show running` output. If you execute `write memory` after configuring an ACL, it also appears in the `show config` output.

The following output shows IPv4 and IPv6 ACLs configured on various ports and trunks on the switch:

Listing the ACL assignments for ports and trunks

Viewing specific ACL configuration details

This command displays a specific IPv6 or IPv4 ACL configured in the running config file in an easy-to-read tabular format.


	NOTE: This information also appears in the `show running` display. If you execute `write memory` after configuring an ACL, it also appears in the `show config` display.

Syntax:

show access-list <identifier> [config]

Displays detailed information on the content of a specific ACL configured in the running-config file.

For example, suppose you configured the following two ACLs in the switch:

Identifier	Type	Desired action
Accounting	IPv6	Permit Telnet traffic from these two IPv6 addresses: 2001:db8:0:1af::10: 14 2001:db8:0:1af::10: 24 Deny Telnet traffic from all other devices in the same subnet. Permit all other IPv6 traffic from the subnet. Deny and log any IPv6 traffic from any other source.
List-120	IPv4 Extended	Permit any TCP traffic from 10.30.133.27 to any destination. Deny any other IPv4 traffic from 10.30.133.(1-255). Permit all other IPv4 traffic from any source to any destination.

Use show access-list <identifier> to inspect a specific IPv6 or IPv4 ACL, as follows:

Listing an IPv6 ACL

Listing an IPv4 extended ACL

The show access-list <identifier> config command shows the same ACL data as show access-list <identifier but in the format used by the show <run|config> commands to list the switch configuration. For example:

An ACL listed with the "Config" option

Descriptions of data types included in show access-list <acl-id> output

Field	Description
Name	The ACL identifier. Can be a number from 1 to 199, or a name.
Type	Standard or Extended. The former uses only source IPv4 addressing. The latter uses both source and destination IPv4 addressing and also allows TCP or UDP port specifiers.
Applied	"Yes" means the ACL has been applied to a port or VLAN interface. "No" means the ACL exists in the switch configuration, but has not been applied to any interface, and is therefore not in use.
SEQ	The sequential number of the Access Control Entry (ACE) in the specified ACL.
Entry	Lists the content of the ACEs in the selected ACL.
Action	Permit (forward) or deny (drop) a packet when it is compared to the criteria in the applicable ACE and found to match. Includes the optional log option, if used, in deny actions.
Remark	Displays any optional remark text configured for the selected ACE.
IP	Used for Standard ACLs: The source IPv4 address to which the configured mask is applied to determine whether there is a match with a packet.
Src IP	Used for Extended ACLs: Same as above.
Dst IP	Used for Extended ACLs: The source and destination IPv4 addresses to which the corresponding configured masks are applied to determine whether there is a match with a packet.
Mask	The mask configured in an ACE and applied to the corresponding IPv4 address in the ACE to determine whether a packet matches the filtering criteria.
Proto	Used only in extended ACLs to specify the packet protocol type to filter. Must be either IPv4, TCP, or UDP. For TCP protocol selections, includes the `established` option, if configured.
Port(s)	Used only in extended ACLs to show any TCP or UDP operator and port number(s) included in the ACE.
TOS (HP Switch 2620-series)	Used only in extended ACLs to indicate Type-of-Service setting, if any.
Precedence (HP Switch 2620-series)	Used only in extended ACLs to indicate the IP precedence setting, if any.

Viewing all ACLs and their assignments in the routing switch startup-config and running-config files

The show config and show running commands include in their listings any configured ACLs and any ACL assignments to VLANs. Remember that show config lists the startup-config file and show running lists the running-config file.

prev	up	next
Editing an existing ACL	home	Creating or editing an ACL offline