PIX 6.2 Question

[jmanning]

I have this access-list:


access-list ipsec permit ip 10.10.2.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 172.23.16.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 205.190.168.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 170.102.0.0 255.255.0.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 198.206.246.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 192.56.231.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 160.69.0.0 255.255.0.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 192.158.58.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 12.15.28.0 255.255.255.0 10.10.32.0 255.255.255.0
access-list ipsec permit ip 10.10.2.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 172.23.16.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 205.190.168.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 170.102.0.0 255.255.0.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 198.206.246.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 192.56.231.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 160.69.0.0 255.255.0.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 192.158.58.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 12.15.28.0 255.255.255.0 10.10.33.0 255.255.255.0
access-list ipsec permit ip 192.158.61.0 255.255.255.0 10.10.32.0 255.255.255.0


I need to remove the last line and only the last line. Can I do a "no access-list ipsec permit ip 192.158.61.0 255.255.255.0 10.10.32.0 255.255.255.0" to remove it or will that remove the whole list. I don't work with PIXs very often and I'm not sure if they work the same as routers.

 

[Saeed42]

If I remember correctly you can remove access list one by one unlike routers.

to be on the save side a factitious access-list and then remove it


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[BuckWeet]

do this

copy that entire access-list to another one called something like "ipsec2" put ipsec2 into use, then go in, copy that info to wordpad, remove the lines you don't want.

Go back into the pix, remove "ipsec" then repaste your new config, then make the ipsec one active again..


BuckWeet

 

[jimmyzz]

jmanning,
you can safefully remove an access list on a PIX without affecting the whole access group, using the 'no' command as you have orginally posted.

JimmyZ