How to remove access list entry? 1

[jt123]

Greetings all,

Can someone please tell me how to remove line 7 from the following Cisco configuration?

1 access-list 101 permit tcp any any established
2 access-list 101 permit icmp any any echo
3 access-list 101 permit icmp any any echo-reply
4 access-list 101 permit icmp any any packet-too-big
5 access-list 101 permit icmp any any time-exceeded
6 access-list 101 permit icmp any any unreachable
7 access-list 101 permit icmp any any echo-reply log

I've tried "no access-list 101 permit icmp any any echo-reply log" but that deletes the whole access list 101. Is there a way to erase just a single entry?

Thanks,

JT

 

[sobak]

Okay I went through this as well. Had a heck of a time trying to figure it out so I'll tell you the way I do it...

Connect to your router through a Telnet connection.
do a "copy run tftp" and copy the running config to your desktop.

Open the file in Wordpad and edit the line you want.

Highlight just the entire list and choose copy.....

Go back to your Telnet session and delete the access list. then past what you have on the clipboard (what you copied from wordpad) into the telnet session and that is it.

Not a real easy way to do it but you'll get real use to it once you do it all the time like I do.

Hope this helps...

david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*

 

[sobak]

To answer you question in your post..... No it's all or nothing on the "No access-list" command. david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*

 

[ShaunG]

From config t do the following:

Rotuer(config)#ip access-list extended 101
Router(config-ext-nacl)#no permit icmp any any echo-reply log
Router(config-ext-nacl)#end

That will allow you to remove the one line.

 

[sobak]

Hey JT let me know if this works, that would save me a lot of time...

david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*

 

[ShaunG]

It works in all IOS's later then 11.2. It's actually used for named access-lists, but works for numbered ones as well. It just assumes the access list is named '101'.

You can go to

http://www.cisco.com/univercd/cc/td...20/12cgcr/np1_c/1cprt2/1cip.htm#xtocid2162616

for more information on named access lists.

 

[sobak]

ShaunG,

That's cool, I'll have to try this in the future......All the books that I had said it couldn't be done. Thanks for the tip.. david e
*end users are just like computers, some you can work with...others just need a simple reBOOTing to fix their problems.*