Adding Entries to an Existing ACL on an ASA

Adding Entries (ACEs) to an Existing ACL

You can add entries to ACLs on ASAs by using the line number command. Line numbers on ASAs work differently than on routers. They are not stored in the configs and they will not show up in a show access-list command (basically the ASA doesn't keep the numbers, they are just used for inserting). To do this, just count the line numbers and tell the ASA where you want the new one to go. The existing line of that number will move down (e.g. if you insert at line 3, the old line 3 will become line 4 because you have just added a line above it).  

! Test ACL

access-list TEST_ACL extended permit ip 10.1.1.1 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.2 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.3 255.255.255.255 any

! Implicit Deny

! Deny access from 10.1.1.1 to evil DNS servers 4.2.2.2 and 8.8.8.8. We need this to be above the permit any from 10.1.1.1 so the denies will take effect.
! We can use line numbers to do this
access-list TEST_ACL line 1 extended deny ip 10.1.1.1 255.255.255.255 4.2.2.2
access-list TEST_ACL line 2 extended deny ip 10.1.1.1 255.255.255.255 8.8.8.8
!

!NEW ACL
access-list TEST_ACL extended deny ip 10.1.1.1 255.255.255.255 4.2.2.2
access-list TEST_ACL extended deny ip 10.1.1.1 255.255.255.255 8.8.8.8
access-list TEST_ACL extended permit ip 10.1.1.1 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.2 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.3 255.255.255.255 any

! Ooops, we forgot to deny access from 10.1.1.2 to these same evil DNS servers
access-list TEST_ACL line 1 extended deny ip 10.1.1.2 255.255.255.255 4.2.2.2
access-list TEST_ACL line 2 extended deny ip 10.1.1.2 255.255.255.255 8.8.8.8
!

!New New ACL
!NEW ACL
access-list TEST_ACL extended deny ip 10.1.1.2 255.255.255.255 4.2.2.2
access-list TEST_ACL extended deny ip 10.1.1.2 255.255.255.255 8.8.8.8
access-list TEST_ACL extended deny ip 10.1.1.1 255.255.255.255 4.2.2.2
access-list TEST_ACL extended deny ip 10.1.1.1 255.255.255.255 8.8.8.8
access-list TEST_ACL extended permit ip 10.1.1.1 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.2 255.255.255.255 any
access-list TEST_ACL extended permit ip 10.1.1.3 255.255.255.255 any

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/acl_extended.html#wp1074591

  Adding an Extended Access List

An access list is made up of one or more access control entries (ACEs) with the same access list ID. To create an access list you start by creating an ACE and applying a list name. An access list with one entry is still considered a list, although you can add multiple entries to the list.

To add an extended access list or an ACE, enter the following command:

Command

Purpose

access-list access_list_name [line line_number] [extended] {deny | permit} protocol source_address mask [operator port] dest_address mask [operator port | icmp_type] [inactive] Example: hostname(config)# access-list ACL_IN extended permit ip any any

Adds an extended access control entry. The line line_number options specify the line number at which insert the ACE. If you do not specify a line number, the ACE is added to the end of the access list. The line number is not saved in the configuration; it only specifies where to insert the ACE. The extended option adds an ACE. The deny keyword denies a packet if the conditions are matched. Some features do not allow deny ACEs, such as NAT. See the command documentation for each feature that uses an access list for more information. The permit keyword permits a packet if the conditions are matched. The protocol argument specifies the IP protocol name or number. For example UDP is 17, TCP is 6, and EGP is 47. The source_address specifies the IP address of the network or host from which the packet is being sent. Enter the host keyword before the IP address to specify a single address. In this case, do not enter a mask. Enter the any keyword instead of the address and mask to specify any address. The operator port option matches the port numbers used by the source or destination. The permitted operators are as follows: •lt—less than. •gt—greater than. •dq—equal to. •neq—not equal to. •range—an inclusive range of values. When you use this operator, specify two port numbers, for example: range 100 200. The dest_address argument specifies the IP address of the network or host to which the packet is being sent. Enter the host keyword before the IP address to specify a single address. In this case, do not enter a mask. Enter the any keyword instead of the address and mask to specify any address. The icmp_type argument specifies the ICMP type if the protocol is ICMP. The inactive keyword disables an ACE. To reenable it, enter the entire ACE without the inactive keyword. This feature enables you to keep a record of an inactive ACE in your configuration to make reenabling easier. (See the access-list extended command in the Cisco Security Appliance Command Reference for more information about command options.)

Default Interface Cisco Command

I can't even count the number of times I've tried to remove all the configs from an interface by doing a no interface command. The router or switch always replies with a snarky "Removal of physical interfaces is not permitted." I then copy all the commands for the interface, open up notepad, put a no in front of all the ones I don't want and then paste it back into the CLI.

A 10 second change has now taken 2 minutes and increased my frustration level unnecessarily.

 Default to the rescue. Just use this command to return the physical interface and any subinterfaces to their default (unconfigured) values. Note: if you only want to default a single subinterface, you can just do a no to remove it and then add it back in.  

default

default fa0/1



http://blog.ioshints.info/2007/06/default-interface-configuration-command.html
http://www.cisco.com/en/US/docs/ios/12_2t/inter/command/reference/irftdce.html#wp1081863

Cisco - CUE - Show Voicemail Email Notification Settings for a User from CLI

 show voicemail notification owner email

Check Dropped Packets

show policy-map interface

Cisco Config Archive and Replace

Sweet.

http://www.fryguy.net/2011/06/06/cisco-archive-and-configure/

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtrollbk.html#wp1066709

Cisco Command Tricks - Monitoring Performance

Show the list of tasks running sorted by CPU usage and excluding any that are using 0%

sh proc cpu sorted | ex 0.00

Show spanning tree changes

show spanning-tree detail | inc ieee|occur|from|is exec

Show interface counter errors

sh interface counters errors 

sh int | i line|error

Show interface queue statuses and drops

sh int | in Input|line

Cisco Routers - Use Local Timezone for Log Timestamps

Router log timestamp entries are different from the system clock when the NTP is configured

VERSION 2 

Core Issue

If a router is configured to get the time from a Network Time Protocol (NTP) server, the times in the router's log entries may be different from the time on the system clock if the [localtime] option is not in the service timestamps log command. In the example below, the router gets its time from an NTP server and theservice timestamps log datetime command is issued. The show clockcommand displays a time of 14:12:26, yet when a configuration change is made immediately after the show clock command, the log message shows a time of 21:12:28, as shown in this example:

clock timezone PST -8
clock summer-time PDT recurring
service timestamps debug datetime
service timestamps log datetime
logging buffered 16000 debugging
ntp clock-period 17179272
ntp server 161.181.92.152

router#show clock
14:12:26.312 PDT Thu Apr 27 2000
router#config t
Enter configuration commands, one per line. End with CNTL/Z.
router(config)#exit
router#
Apr 27 21:12:28: %SYS-5-CONFIG_I: Configured from console by vty0

Resolution

Add the [localtime] option to the service timestamps log command. For example, if the current configuration is service timestamps log datetime, issue this global configuration command:

router(config)#service timestamps log datetime localtime
router(config)#^Z (ctrl z to exit)
router#write mem

The times should now be synchronized between the system clock and the log message timestamps.

https://supportforums.cisco.com/docs/DOC-4687

Cisco - ISDN Plan Map

Apparently Cisco CME creates its own ISDN call plan rule set automagically. With some vendors, when you send across a number which begins with 011 and plan type international their switches freak out. You can override this treatment by applying an ISDN MAP to the serial interface of the PRI.

interface Serial0/2/0:23
isdn map address 011.* plan isdn type unknown

Reference:
http://www.cisco.com/en/US/docs/ios/dial/command/reference/dia_i2.html

isdn map

To override the default ISDN type and plan generated by the router with custom values, use the isdn map command in interface configuration mode. To revert to the default ISDN type and plan, use the no form of this command.

isdn map address {{address | reg-exp} plan plan type type | transparent}

no isdn map address {{address | reg-exp} plan plan type type | transparent}

Syntax Description

address	Specifies that the default ISDN type and plan will be overridden.
address	Address map, which can be to either the calling number or the called number. This argument specifies the address for which the ISDN type and plan will be overridden.
reg-exp	Regular expression for pattern matching. This argument specifies that the ISDN type and plan will be overridden for addresses that match the regular expression.
plan plan	ISDN numbering plan. Valid values for the plan argument are as follows: •any—Any type of dialed number. •data—X.121 data numbering plan. •ermes—European Radio Message System numbering plan. •isdn—E.164 ISDN/Telephony numbering plan. •national—Number called to reach a subscriber in the same country, but outside the local network. •private—Private numbering plan. •reserved—Reserved for extension. •telex—F.69 telex numbering plan. •unknown—Number of a type that is unknown by the network.
type type	ISDN number type. Valid values for the type argument are as follows: •abbreviated—Abbreviated representation of the complete number as supported by this network. •any—Any type of called number. •international—Number called to reach a subscriber in another country. •national—Number called to reach a subscriber in the same country, but outside the local network. •network—Administrative or service number specific to the serving network. •reserved—Reserved for extension. •subscriber—Number called to reach a subscriber in the same local network. •unknown—Number of a type that is unknown by the network.
transparent	Specifies that the ISDN type and plan values received in raw messages from the ISDN originating gateway will take priority over the ISDN type and plan values received in the H.225 SETUP messages.

Command Default

The default is the ISDN type and plan generated by the router.

Command Modes

Interface configuration

Command History

Release	Modification
12.0(6)T	This command was introduced.
12.3(7)T	The transparent keyword was added.

Usage Guidelines

The default ISDN type and plan can be overridden with custom values on a per-number basis or for numbers that match regular expression patterns.

If you use the isdn map command to configure custom values for the ISDN type and plan, these values take priority over any other ISDN type and plan values. The order of precedence for ISDN type and plan values is as follows, beginning with the highest precedence:

•Type and plan values configured with the isdn map command.

•Type and plan values from voice translation rules specified with the rule (voice translation-rule) command.

•Values received in the H.225 SETUP messages.

•Values received from the ISDN originating gateway in raw messages.

Configuring the isdn map command with the transparent keyword results in raw messages received from the ISDN originating gateway receiving priority over H.225 SETUP messages. When the isdn map command is configured with thetransparent keyword, the order of precedence for ISDN type and plan values is as follows:

•Type and plan values configured with the isdn map command.

•Type and plan values from voice translation rules specified with the rule (voice translation-rule) command.

•Values received from the ISDN originating gateway in raw messages.

•Values received in the H.225 SETUP messages.

Examples

The following example overrides any plan and type used for any ISDN calls with a called or calling number that exactly matches 123:

interface serial1:23

 isdn map address 123 plan isdn type unknown 

The following example overrides any plan and type used for ISDN calls with a called or calling number that begins with the numerals 12:

interface serial1:23

 isdn map address 12.* plan data type subscriber

The following example matches any number that ends with the number 7:

interface serial1:23

 isdn map address .*7 plan data type subscriber

The following example reverses the precedence of ISDN type and plan values received from the ISDN originating gateway and from the H.225 SETUP message:

interface serial1:23

 isdn map address transparent

Related Commands

Command	Description
rule (voice translation-rule)	Defines a translation rule.

Cisco CLI - Show Command Section Filter and Other CLI Shortcuts

One of the most useful Cisco show filters ever is the new(ish) section filter. This lets you view information from the section you specify. For example, show run | section include ephone  12 will return all the config lines in the running config which pertain to your ephone 12. The section command (like all Cisco show command filters) is case sensitive and doesn't allow tab completions or etc - you need to type exactly what you're looking for (or at least the beginning of what you're looking for).Note that per one site: "Cisco considers a section to be a line with no leading blank and includes all lines following it until the start of the next section."

! awesome. Now I don't have to filter through the config looking for the ephone  12 config.
2821#sh run | s i ephone  12
ephone  12
 device-security-mode none
 description Ryan IP Communicator
 video
 mac-address 0023.AE7F.0000
 type CIPC
 button  1:2 2:10
2821#

When I first start working on a router, I'll usually grab a copy of the running config and throw it into a txt file. Then I search through it for whatever I want. Once I find the relevant pieces, I'll copy them over to a new text file and prep the changes I want to make. Then I'll apply the changes to the router.

! term len 0 sets the terminal length to no pauses so you can get the complete config at once.
Rtr#term len 0
Rtr#sh run
! now do a copy all to clipboard from putty and paste into a text document. 

Verifying the changes is where the section filter can really be helpful. Rather than getting a complete new copy of the config and sifting through it, just do a sh run | s i whatever I'm looking for

. On major changes, I will always save the starting configs and the ending configs and compare them with WinMerge. However, the section command works very well to make sure everything is going well as I make each change.
 

So overall, the section command filter is a great shortcut. However, if you are looking for data on an interface, you should use show run interface . This method will allow for tabbed completions, abbreviations and isn't case sensitive so it is faster and better for this type of work than the section filter. It won't work with the variety of items that the section command will though. 

! annoying because I had to type this all the way out and even capitalize it correctly
2821#sh run | s i interface GigabitEthernet0/0
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
 bridge-group 1

! less annoying - just do sh run int and use tab completion or abbreviations like you normally would.
2821#sh run int gigabitEthernet 0/0
Building configuration...

Current configuration : 92 bytes
!
interface GigabitEthernet0/0
 no ip address
 duplex auto
 speed auto
 bridge-group 1
end

2821#

Show Section Command Filter Links
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gtshfltr.html
http://www.techexams.net/forums/ccna-ccent/37408-show-run-section.html
http://cciepursuit.wordpress.com/2007/07/17/must-use-command-filtering-output-with-the-section-command/
http://www.nil.com/C1256F0A00429755/html/EnhanceIOSUI/
Cisco Documentation:

Command Reference

This section documents new commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.

•show section

show section

To filter the output of a show command to match a given expression as well as any lines associated with that expression, use the show command section command in privileged EXEC mode.

show command | section [include | exclude] regular-expression

Syntax Description

command	Any Cisco IOS show command.
include	(Optional) Includes only the lines that contain a particular regular expression. This is the default keyword when none is specified.
exclude	(Optional) Excludes any lines that contain a particular regular expression.
regular-expression	Any regular-expression (text string) found in show command output.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.3(2)T	This command was introduced.

Usage Guidelines

In many cases, it is useful to filter the output of a show command to match a specific expression. Filtering provides some control over the type and amount of information displayed by the system. The show section command provides enhanced filtering capabilities by matching lines in the show command output containing specific expressions as well as matching any entries associated with those expressions. Filtering is especially useful, for example, when displaying large configuration files using the show running-configuration command or the show interfaces command.

If the include or exclude keyword is not specified, include is the default.

If there are no associated entries for an expression, then only the line matching the expression is displayed.

Examples

The following examples compare the filtering characteristics of the show running-config | include command with the show running-config | section command. The first example gathers just the lines from the configuration file with "interface" in them.

Router# show running-config | include interface

interface Ethernet0/0 
interface Ethernet1/0 
interface Serial2/0 
interface Serial3/0

The next example uses the show command section command to gather the lines in the configuration file with "interface" in them as well as any lines associated with those entries. In this example, interface configuration information is captured.

Router# show running-config | section include interface

interface Ethernet0/0 
 shutdown 
 no cdp enable

interface Ethernet1/0 
 shutdown 
 no cdp enable 
interface Serial2/0 
 shutdown 
 no cdp enable 
interface Serial3/0 
 shutdown 
 no cdp enable

Related Commands

Command	Description
show append	Redirects the output of any show command and adds it to the end of an existing file.
show exclude	Filters show command output so that it excludes lines that contain a particular regular expression.
show include	Filters show command output so that it displays only lines that contain a particular regular expression.
show redirect	Redirects the output of any show command to a specified file.

Information About the Show Command Section Filter

The Show Command Section Filter feature enhances the functionality of the Cisco IOS CLI by filtering show command output matching a regular expression (text string) as well as filtering output associated with that expression. Prior to this enhancement, the level of filtering offered by the show command was limited to the individual lines of the output.

In many cases, it is useful to filter the output of a show command to match a specific expression. Filtering provides some control over the type and amount of information displayed by the system. With section filtering, show command output not only displays the individual entries matching the expression in the command output but also displays the section of entries associated with that expression.

Filtering is especially useful, for example, when displaying a large configuration file. In this case, it is helpful to display sections of the configuration file without having to enter multiple commands to gather the related configuration information.