思科命令显示ACL应用于哪些接口

17

对于Cisco路由器和交换机，是否使用show命令或类似命令显示将ACL实施在哪些物理和逻辑接口上以及将其应用到什么方向？

我正在寻找比.com更简单的东西show run | <some regex>。

cisco  switch  router  acl  interface 
— 亚当·洛夫莱斯
source

Answers:

18

我不认为有任何事情比show interfaces | <some regex>不幸的要简单。

编辑：

从下面的评论，@ 桑提诺指出了一个更简洁的正则表达式：

show ip interface | include line protocol|access list

到目前为止，我的测试表明，此结果与下面的较长RegEx相同。

我通常使用以下内容查找应用ACL的位置：

show ip interface | include is up|is administratively|is down|Outgoing|Inbound

这为您提供了每个接口，无论状态如何，出站和入站ACL都是什么。例如：

LAB-4510-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound 
Vlan1 is administratively down, line protocol is down
Vlan110 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is VENDOR->INTERNET
Vlan140 is administratively down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is not set
Vlan150 is down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is VENDOR->INTERNET
Vlan210 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
FastEthernet1 is administratively down, line protocol is down
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet1/1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet1/2 is down, line protocol is down
  Inbound  access list is not set
  Outgoing access list is not set

对于每个接口，依此类推。

此命令在思科交换机和路由器上均有效。请参阅下面的7200路由器的示例输出：

LAB-7204-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound
GigabitEthernet0/1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
FastEthernet0/2 is administratively down, line protocol is down
GigabitEthernet0/2 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
GigabitEthernet0/3 is administratively down, line protocol is down
SSLVPN-VIF0 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
Loopback0 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
Loopback1 is up, line protocol is up
  Outgoing access list is not set
  Inbound  access list is not set
— 布雷特·莱金斯（Brett Lykins）
source
3
您可以将其缩短为show ip interface | include line protocol|access list For NX-OS，show ip access-list summary
— Santino
1
@Santino，是的！我将相应地编辑答案。此外，在做进一步研究时，我还发现PacketLife的Jeremy Stretch over已经走了这条路，另外还有一个较短的RegEx（但不如您的短）：show ip interface | include line protocol|access list is [^ ]+$ 我不确定是否有理由我们需要额外的RegEx匹配在“访问列表”之后。
— Brett Lykins 2013年
2
Stretch的正则表达式将过滤掉未设置的访问列表行。他的正则表达式的末尾匹配一个单词，该单词将匹配ACL，因为它们不能有空格。好发现。
— 桑蒂诺（Santino）
1
@Santino，这很有道理！感谢您的解释。要回弹力的页面后，我看到的解释有太多... ::阅读失败::对我而言:)
— 布雷特Lykins
3

如果您有show run | <some regex>喜欢的命令来显示所需的信息，则始终可以使用别名。

使用此命令的示例： alias exec shacls sh ip int | inc line protocol|access list is [^ ]+$。

然后，您可以使用alias-name（在本例中为shacls），它将与show run | <some regex>

注意：您需要在每个IOS设备上执行此操作。ASA略有不同。

编辑：我不能相信sh ip int | inc line protocol|access list is [^ ]+$这是因为PacketLife IOS Tips。

— 狂欢
source
1

我之前很在意这个，发现了一个相当直观的正则表达式，可以满足您的需求。

sho ip int | inc ^ [AZ] |访问列表

需要使用该列表来忽略访问冲突行。

— 欧米茄
source
-1

在Nexus设备上，您可以发布show access-list摘要或show ip access-list摘要

— 乔乔
source
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.