Viewing
Viewing an ACL summary
This command lists the configured IPv4 and IPv6 ACLs, regardless of whether they are assigned to any VLANs.
Syntax
show access-list
List a summary table of the name, type, and application status of IPv4 and IPv6 ACLs configured on the switch.
| Term | Meaning |
|---|---|
| Type | Shows whether
the listed ACL is an IPv4 std ACL, an IPv4 extACL,
or an IPv6 ACL. |
| Appl | Shows whether
the listed ACL has been applied to an interface (yes/no). |
| Name | Shows the identifier (name or number) assigned to each ACL configured in the switch. |
Viewing the content of all ACLs on the switch
This command lists the configuration details for the IPv4 and IPv6 ACLs in the running-config file, regardless of whether any are actually assigned to filter IPv4 traffic on specific VLANs.
Syntax
show access-list configList the configured syntax for all IPv4 and IPv6 ACLs currently configured on the switch.
![[NOTE: ]](images/note.gif) | NOTE: Notice that you can use the output from this command for input to an offline text file in which you can edit, add, or delete ACL commands. See Enabling ACL logging on the switch. This information also appears in the |
An ACL configured syntax listing shows the ACLs on a switch configured with two IPv6 ACLs named "Accounting" and "List-01-Inbound", and one extended IPv4 ACL named "101":
Viewing the RACL and VACL assignments for a VLAN
This command briefly lists the identification andtypes of IPv4 RACLs and IPv4 and IPv6 VACLs currently assigned to a particular VLAN in the running-config file. For IPv4, the switch supports, per-VLAN, one inbound and one outbound RACL assignment per VLAN, plus one VACL assignment. For IPv6, the switch supports, per-VLAN, one VACL assignment.
Syntax
show access-list vlan <vid>Lists the current IPv4 and IPv6 ACL assignments to the specified VLAN (in the running config file).
| NOTE: This information also appears in the |
Example
The following output shows that all inbound IPv6 traffic and the inbound and outbound, routed IPv4 traffic are all filtered on VLAN 20.
Viewing static port (and trunk) ACL assignments
This command lists the identification and types of current static port ACL assignments to individual switch ports and trunks, as configured in the running-config file. The switch allows one static port ACL assignment per port.
Syntax
show access-list ports <all |port-list>Lists the current static port ACL assignments for ports and trunks in the running config file.
| NOTE: This information also appears in the |
Example
The following output shows IPv4 and IPv6 ACLs configured on various ports and trunks on the switch:
Viewing specific ACL configuration details
This command displays a specific IPv6 or IPv4 ACL configured in the running config file in an easy-to-read tabular format.
| NOTE: This information also appears in the For information on IPv4 ACL operation, see the latest version of the access security guide for your switch. |
Syntax
show access-list <identifier> [ config]
Displays detailed information on the content of a specific ACL configured in the running-config file.
For example, suppose you configured the following two ACLs in the switch:
| Identifier | Type | Desired action |
|---|---|---|
| Accounting | IPv6 |
|
| List-120 | IPv4 Extended |
|
Use show access-list <identifier> to
inspect a specific IPv6 or IPv4 ACL, as follows:
The show access-list command
shows the same ACL data as identifier configshow access-list <identifier> but
in the format used by the show <run | config> commands
to list the switch configuration. For example:
Descriptions of data types included in show access-list <acl-id> output
| Field | Description |
|---|---|
| Name | The ACL identifier. Can be a number from 1 to 199, or a name. |
| Type | Standard or Extended. The former uses only source IPv4 addressing. The latter uses both source and destination IPv4 addressing and also allows TCP or UDP port specifiers. |
| Applied | "Yes" means the ACL has been applied to a port or VLAN interface. "No" means the ACL exists in the switch configuration, but has not been applied to any interface, and is therefore not in use. |
| SEQ | The sequential number of the Access Control Entry (ACE) in the specified ACL. |
| Entry | Lists the content of the ACEs in the selected ACL. |
| Action | Permit (forward) or deny (drop) a packet when it is compared to the criteria in the applicable ACE and found to match. Includes the optional log option, if used, in deny actions. |
| Remark | Displays any optional remark text configured for the selected ACE. |
| IP | Used for Standard ACLs The source IPv4 address to which the configured mask is applied to determine whether there is a match with a packet. |
| Src IP | Used for Extended ACLs Same as above. |
| Dst IP | Used for Extended ACLs The source and destination IPv4 addresses to which the corresponding configured masks are applied to determine whether there is a match with a packet. |
| Mask | The mask configured in an ACE and applied to the corresponding IPv4 address in the ACE to determine whether a packet matches the filtering criteria. |
| Proto | Used only in extended ACLs to specify the packet protocol type to filter. Must be either IPv4, TCP, or UDP. For TCP protocol selections, includes the established option, if configured. |
| Port(s) | Used only in extended ACLs to show any TCP or UDP operator and port numbers included in the ACE. |
| TOS | Used only in extended ACLs to indicate Type-of-Service setting, if any. |
| Precedence | Used only in extended ACLs to indicate the IP precedence setting, if any. |
Viewing all ACLs and their assignments in the routing switch startup-config and running-config files
The show config and show
running commands include in their listings any configured
ACLs and any ACL assignments to VLANs. See ACL configuration factors.
Remember that show config lists the startup-config
file and show running lists the running-config file.