Viewing the content of a specific ACL
Displays a specific IPv6 or IPv4 ACL configured in the running config file in an easy-to-read tabular format.
Syntax:
show access-list
<identifier> [config]
Displays detailed information on the content of a specific ACL configured in the running-config file.
This information also appears in the
show running
display. If you execute
write memory
after configuring an ACL, it also appears in the
show config
display.
For information on IPv4 ACL operation, see the latest version of the ArubaOS-Switch Access Security Guide for your switch.
For example, suppose you configured the following two ACLs in the switch:
Identifier |
Type |
Desired action |
---|---|---|
Accounting |
IPv6 |
|
List-120 |
IPv4 Extended |
|
Use
show access-list
<identifier>
to inspect a specific IPv6 or IPv4 ACL, as follows:
Listing an IPv6 ACL
Switch(config)# show access-list Accounting Access Control Lists Name: Accounting Type: ipv6 Applied: Yes SEQ Entry –––––––––––––––––––––––––––––––––––––––––––––––––––––––– 10 Action: permit Remark: Telnet Allowed 1 Src IP: 2001:db8:0:1af::10:14 Prefix Len: 128 2 Dst IP: :: 3 Prefix Len: 0 Src Port(s): 4 Dst Port(s): eq 23 5 Proto : TCP Option(s):6 Dscp : -7 20 Action: permit Src IP: 2001:db8:0:1af::10:23 8 Prefix Len: 128 Dst IP: :: 9 Prefix Len: 0 Src Port(s): Dst Port(s): eq 23 Proto : TCP Option(s): Dscp : - 30 Action: deny (log) Src IP: 2001:db8:0:1af::10 Prefix Len: 116 Dst IP: :: Prefix Len: 0 Src Port(s): Dst Port(s): Proto : TCP Option(s): Dscp : -
1 Indicates whether the ACL is applied to an interface
2 Remark Field (appears if remark configured)
3 Source Address
4 Destination Address
5 TCP Destination Port (Note: An empty TCP field indicates that the TCP port number for that field can be any value)
6 Source and Destination Prefix Lengths
7 TCP Source Port
8 Protocol Data
9 DSCP Codepoint or Precedence
Listing an IPv4 extended ACL
Switch(config)# show access-list List–120 Access Control Lists Name: List–120 Type: Extended Applied: No 1 SEQ Entry –––––––––––––––––––––––––––––––––––––––––––––––––––––––––– 10 Action: permit Remark: Telnet Allowed 2 Src IP: 10.30.133.27 3 Mask: 0.0.0.0 Port(s): eq 23 Dst IP: 0.0.0.0 4 Mask: 255.255.255.255 Port(s): 5 Proto : IP 6 TOS : - Precedence: - 7 20 Action: deny (log) Src IP: 10.30.133.1 Mask: 0.0.0.255 Port(s): Dst IP: 0.0.0.0 Mask: 255.255.255.255 Port(s): Proto : IP TOS : - Precedence: - 30 Action: permit Src IP: 0.0.0.0 Mask: 255.255.255.255 Port(s): Dst IP: 0.0.0.0 Mask: 255.255.255.255 Port(s): Proto : IP TOS : - Precedence: -
1 Indicates whether the ACL is applied to an interface
2 Remark Field (Appears if remark configured)
3 Source Address
4 TCP Source Port
5 Protocol Data
6 Empty field indicates that the destination TCP port can be any value
7 DSCP Codepoint and Precedence Data
The
show access-list
<identifier> config
command shows the same ACL data as
show access-list
<identifier>
but in the format used by the
show <run|config>
commands to list the switch configuration.
An ACL listed with the config option
Switch(config)# show access-list List–120 config ip access-list extended "List–120" 10 remark "Telnet Allowed" 10 permit tcp 10.30.133.27 0.0.0.0 eq 23 0.0.0.0 255.255.255.255 precedence 0 established 20 deny ip 10.30.133.1 0.0.0.255 0.0.0.0 255.255.255.255 log 30 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 exit
Field |
Description |
---|---|
Name |
The ACL identifier. For IPv6 ACLs, is an alphanumeric name. For IPv4 ACLs, can be a number from 1 to 199, or an alphanumeric name. |
Type |
IPv6, Standard, or Extended. IPv6 ACLs use a source and a destination address, plus IPv6 protocol specifiers.
|
Applied |
“ |
SEQ |
The sequential number of the ACE in the specified ACL. |
Entry |
Lists the content of the ACEs in the selected ACL. |
Action |
Permit (forward) or deny (drop) a packet when it is compared to the criteria in the applicable ACE and found to match. Includes the optional
|
Remark |
Displays any optional remark text configured for the selected ACE. |
IP |
Used for IPv4 standard ACEs: The source IPv4 address to which the configured mask is applied to determine whether there is a match with a packet. |
Src IP |
Used for IPv6 ACEs and IPv4 extended ACEs: The source IPv6 or IPv4 address to which the configured mask is applied to determine whether there is a match with a packet. |
Dst IP |
Used for IPv6 ACEs and IPv4 extended ACEs: The source and destination IP addresses to which the corresponding configured masks are applied to determine whether there is a match with a packet. |
Mask |
Used in IPv4 ACEs, the mask is configured in an ACE and applied to the corresponding IP address in the ACE to determine whether a packet matches the filtering criteria. |
Prefix Len (source and destination) |
Used in IPv6 ACEs to specify the number of consecutive high-order (leftmost) bits of the source and destination addresses configured in an ACE to be used to determine a match with a packet being filtered by the ACE. |
Proto |
Used in IPv6 ACEs and IPv4 extended ACEs to specify the packet protocol type to filter. |
Port(s) |
Used in IPv4 extended ACEs to show any TCP or UDP operator and port numbers included in the ACE. |
Src Port(s)Dst Port(s) |
Used in IPv6 ACEs to show TCP or UDP source and destination operator and port numbers included in the ACE. |
Field |
Description |
---|---|
Name |
The ACL identifier. For IPv6 ACLs, is an alphanumeric name. For IPv4 ACLs, can be a number from 1 to 199, or an alphanumeric name. |
Type |
IPv6, Standard, or Extended. IPv6 ACLs use a source and a destination address, plus IPv6 protocol specifiers.
|
Applied |
“ |
SEQ |
The sequential number of the ACE in the specified ACL. |
Entry |
Lists the content of the ACEs in the selected ACL. |
Action |
Permit (forward) or deny (drop) a packet when it is compared to the criteria in the applicable ACE and found to match. Includes the optional
|
Remark |
Displays any optional remark text configured for the selected ACE. |
IP |
Used for IPv4 standard ACEs: The source IPv4 address to which the configured mask is applied to determine whether there is a match with a packet. |
Src IP |
Used for IPv6 ACEs and IPv4 extended ACEs: The source IPv6 or IPv4 address to which the configured mask is applied to determine whether there is a match with a packet. |
Dst IP |
Used for IPv6 ACEs and IPv4 extended ACEs: The source and destination IP addresses to which the corresponding configured masks are applied to determine whether there is a match with a packet. |
Mask |
Used in IPv4 ACEs, the mask is configured in an ACE and applied to the corresponding IP address in the ACE to determine whether a packet matches the filtering criteria. |
Prefix Len (source and destination) |
Used in IPv6 ACEs to specify the number of consecutive high-order (leftmost) bits of the source and destination addresses configured in an ACE to be used to determine a match with a packet being filtered by the ACE. |
Proto |
Used in IPv6 ACEs and IPv4 extended ACEs to specify the packet protocol type to filter. |
Port(s) |
Used in IPv4 extended ACEs to show any TCP or UDP operator and port numbers included in the ACE. |
Src Port(s)Dst Port(s) |
Used in IPv6 ACEs to show TCP or UDP source and destination operator and port numbers included in the ACE. |
DSCP |
Used in IPv6 ACEs to show the DSCP precedence or codepoint setting, if any. |
TOS |
Used in IPv4 extended ACEs to indicate Type-of-Service setting, if any. |
Precedence |
Used in IPv4 extended ACEs to indicate the IP precedence setting, if any. |