ip access-list resequence [name] [start] [increment]
Resequences the sequence numbers of entries in a named IP access list to allow insertion of new entries between existing ones.
Definition: ip access-list resequence [name] [start] [increment] is a Cisco IOS global config command. Resequences the sequence numbers of entries in a named IP access list to allow insertion of new entries between existing ones.
Overview
The `ip access-list resequence` command is a powerful utility in Cisco IOS that allows network engineers to renumber the sequence numbers of entries within a named IP access list. Access lists are fundamental to network security and traffic filtering, operating as ordered lists of permit or deny statements. Each entry is assigned a sequence number (typically starting at 10 and incrementing by 10) that determines the order in which the router evaluates the list.
Over time, as you add, remove, or modify entries, the sequence numbers can become sparse or non-sequential, making it difficult to insert new rules between existing ones without rewriting the entire list. This command addresses that by resetting the sequence numbers to a specified starting value and increment, effectively reordering the list while preserving the original order of entries. The networking concept behind this is the need for ordered rule evaluation: the router processes access list entries from lowest to highest sequence number, and once a match is found, no further entries are evaluated.
Therefore, the ability to insert new entries at precise positions is critical for implementing granular traffic policies without disrupting existing rules. You would reach for this command when you need to add a new permit or deny statement between two existing entries, but the current sequence numbers leave no room (e.g., entries at 10 and 20, and you need something between them). Alternatives include removing and re-adding the entire access list with new sequence numbers, which is disruptive and error-prone, or using the `ip access-list extended` command with explicit sequence numbers when creating the list initially.
The resequence command fits into the broader network configuration workflow as a maintenance tool: after initial deployment, network policies evolve, and this command allows incremental updates without service interruption. Important IOS behavior: the command is executed in global configuration mode and immediately modifies the running configuration; the change is not buffered. It requires privilege level 15 (enable mode) to execute.
The output is not displayed on the console; you must use `show access-list` to verify the new sequence numbers. The command does not affect the functionality of the access list—only the sequence numbers change. It is available in IOS 12.0 and later, including IOS-XE.
For named access lists only; numbered access lists cannot be resequenced. The command also works for IPv6 access lists with the `ipv6 access-list resequence` variant.
ip access-list resequence [name] [start] [increment]When to Use This Command
- After adding entries to an ACL with no sequence numbers, resequence to create gaps for future edits.
- When an ACL has entries with sequence numbers that are too close together (e.g., 10, 11, 12), resequence to spread them out (e.g., 10, 20, 30).
- To reorder ACL entries by renumbering them after deleting some entries, making the sequence numbers consistent.
- When troubleshooting ACL order issues, resequence to ensure entries are in the correct order and have proper gaps.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD | The name of the IP access list to resequence. Must be a named access list (standard or extended). Common mistake: using a numbered access list name (e.g., 100) which is not supported; the command only works with named ACLs. |
| start | <1-2147483647> | The starting sequence number for the first entry in the access list. Valid values range from 1 to 2147483647. Typically set to 10 or 100 to allow room for future insertions. Common mistake: setting too high a start value may exceed the maximum sequence number limit for subsequent entries. |
| increment | <1-2147483647> | The increment between sequence numbers for consecutive entries. Valid values range from 1 to 2147483647. Typical values are 10 or 20. Common mistake: using an increment that is too small (e.g., 1) leaves no room for future insertions; too large (e.g., 1000) may cause sequence numbers to exceed the maximum. |
Command Examples
Resequence an ACL with default start and increment
ip access-list resequence MY_ACL 10 10Resequencing of access list MY_ACL done
The command resequences the ACL named MY_ACL starting at sequence number 10 with an increment of 10. The output confirms the operation was successful.
Resequence an ACL with custom start and increment
ip access-list resequence BLOCK_ACL 100 20Resequencing of access list BLOCK_ACL done
This resequences BLOCK_ACL starting at 100 with an increment of 20. The output confirms completion.
Understanding the Output
The output for the 'ip access-list resequence' command is minimal: it simply confirms that the resequencing operation was completed successfully. There are no columns or fields to interpret. The key is to verify that the command executed without errors.
After resequencing, use 'show access-list [name]' to view the new sequence numbers. Good values are evenly spaced sequence numbers (e.g., 10, 20, 30) that allow future insertions. Watch for error messages like 'Access list not found' if the name is incorrect.
Configuration Scenarios
Inserting a new rule between existing entries in an extended ACL
A network administrator needs to add a permit statement for a new server (192.168.1.100) between two existing deny statements in an extended ACL named BLOCK_SERVERS. The current ACL has entries at sequence 10 and 20, leaving no room for insertion.
Topology
R1(Gi0/1)---192.168.1.0/24---Server FarmSteps
- 1.Step 1: View current ACL: R1# show access-list BLOCK_SERVERS
- 2.Step 2: Enter global config: R1# configure terminal
- 3.Step 3: Resequence ACL starting at 10 with increment 10: R1(config)# ip access-list resequence BLOCK_SERVERS 10 10
- 4.Step 4: Verify new sequence numbers: R1(config)# do show access-list BLOCK_SERVERS
- 5.Step 5: Add the new permit entry at sequence 15: R1(config)# ip access-list extended BLOCK_SERVERS
- 6.Step 6: Insert the new rule: R1(config-ext-nacl)# 15 permit tcp any host 192.168.1.100 eq 80
- 7.Step 7: Exit and verify: R1(config-ext-nacl)# end; R1# show access-list BLOCK_SERVERS
! Before resequence ip access-list extended BLOCK_SERVERS 10 deny tcp any host 192.168.1.10 eq 80 20 deny tcp any host 192.168.1.20 eq 80 ! ! Resequence command ip access-list resequence BLOCK_SERVERS 10 10 ! ! After resequence and insertion ip access-list extended BLOCK_SERVERS 10 deny tcp any host 192.168.1.10 eq 80 15 permit tcp any host 192.168.1.100 eq 80 20 deny tcp any host 192.168.1.20 eq 80
Verify: Use 'show access-list BLOCK_SERVERS' to confirm the new sequence numbers and the inserted entry. Expected output shows entries with sequence numbers 10, 15, 20.
Watch out: After resequencing, the ACL is automatically saved to running-config. If you forget to save to startup-config, the new sequence numbers are lost on reload. Also, resequencing does not change the order of evaluation; it only renumbers entries.
Resequencing a standard ACL to reorganize rules
A standard ACL named MGMT_ACCESS is used to control management access to a router. Over time, entries have been added with varying sequence numbers (5, 15, 30, 50). The administrator wants to clean up the numbering to make future insertions easier.
Topology
R2(Lo0)---10.0.0.0/8---Management NetworkSteps
- 1.Step 1: Display current ACL: R2# show access-list MGMT_ACCESS
- 2.Step 2: Enter global config: R2# configure terminal
- 3.Step 3: Resequence with start 10 increment 10: R2(config)# ip access-list resequence MGMT_ACCESS 10 10
- 4.Step 4: Verify: R2(config)# do show access-list MGMT_ACCESS
- 5.Step 5: Save configuration: R2(config)# end; R2# copy running-config startup-config
! Before resequence ip access-list standard MGMT_ACCESS 5 permit 10.0.0.0 0.255.255.255 15 permit 172.16.0.0 0.0.255.255 30 deny any 50 permit 192.168.1.0 0.0.0.255 ! ! Resequence command ip access-list resequence MGMT_ACCESS 10 10 ! ! After resequence ip access-list standard MGMT_ACCESS 10 permit 10.0.0.0 0.255.255.255 20 permit 172.16.0.0 0.0.255.255 30 deny any 40 permit 192.168.1.0 0.0.0.255
Verify: Use 'show access-list MGMT_ACCESS' to see the new sequence numbers: 10, 20, 30, 40. The order of entries remains the same.
Watch out: Resequencing does not change the order of entries; it only reassigns sequence numbers. If you accidentally reverse the order, you must manually reorder the entries. Also, the command does not work on numbered ACLs; use named ACLs only.
Troubleshooting with This Command
When troubleshooting access list issues, the `ip access-list resequence` command is rarely the first tool you reach for, but it becomes essential when you need to insert a new rule at a specific position. Healthy output from `show access-list` shows sequential sequence numbers with consistent increments (e.g., 10, 20, 30). Problem indicators include non-sequential numbers (e.g., 10, 15, 30, 50) or gaps that are too small to insert new entries.
A common symptom is the inability to add a permit statement between two existing deny statements without removing and re-adding the entire list. This command helps diagnose the need for renumbering by revealing the current sequence number layout. The step-by-step diagnostic flow: first, use `show access-list [name]` to display the current entries and their sequence numbers.
If you need to insert a rule between entries with consecutive numbers (e.g., 10 and 20), you cannot do so directly. Second, determine the desired starting sequence number and increment. Typically, start at 10 with increment 10 to leave room for up to 9 insertions between each existing entry.
Third, execute the resequence command. Fourth, verify the new sequence numbers with `show access-list`. Fifth, insert the new entry using the appropriate sequence number.
Correlate this command's output with other show commands like `show running-config | section ip access-list` to see the full ACL configuration. Also, use `show ip interface` to verify which ACL is applied to an interface. If the ACL is applied but traffic is not being filtered as expected, check the sequence numbers to ensure the order is correct.
Remember that resequencing does not change the order of evaluation; it only renumbers. If the ACL is large, resequencing can be done without removing the ACL from the interface, minimizing disruption. However, be aware that resequencing modifies the running configuration immediately, so if you make a mistake, you may need to reload or manually correct the sequence numbers.
In some IOS versions, the command may not be available if the ACL is applied to an interface; remove the ACL first, resequence, then reapply. Always save the configuration after resequencing to preserve the new numbering across reboots.
CCNA Exam Tips
CCNA exam may ask why resequencing is needed: to insert new ACEs between existing ones without removing and re-adding the entire ACL.
Remember that resequencing does not change the order of ACEs; it only renumbers them. The order remains the same.
Know that the default start and increment are both 10, but you can specify custom values.
Be aware that resequencing is only available for named ACLs, not numbered ACLs.
Common Mistakes
Mistake: Forgetting to use 'ip access-list resequence' before adding new entries, resulting in the new entry being appended at the end instead of in the desired position.
Mistake: Using the command on a numbered ACL (e.g., access-list 100) which is not supported; resequence only works with named ACLs.
Mistake: Choosing a start value that is too high, leaving no room for future entries if the increment is small.
ip access-list resequence [name] [start] [increment] vs ip access-list extended [name]
Both commands operate on named IP access lists but serve different purposes: one manages sequence numbering for entry insertion, while the other defines the filtering rules. They are often confused because administrators may forget to resequence after adding entries, or may not distinguish between editing the list and renumbering it.
| Aspect | ip access-list resequence [name] [start] [increment] | ip access-list extended [name] |
|---|---|---|
| Scope | Resequences existing ACL entries | Creates or enters an ACL definition |
| Effect on traffic | No direct effect; changes evaluation order | Directly filters traffic based on entries |
| Mode | Global configuration | Global configuration |
| Persistence | Immediate and saved in running-config | Immediate and saved in running-config |
| Typical use | After inserting entries with same sequence number | Defining permit/deny rules for traffic filtering |
| Precedence | Can be applied at any time; entries evaluated in new sequence order | Must be applied to an interface for traffic effect |
Use ip access-list resequence [name] [start] [increment] when you have added entries with overlapping or out-of-order sequence numbers and need to renumber them sequentially for future insertions.
Use ip access-list extended [name] when you need to define a new named extended access list or enter configuration mode for an existing one to add or modify permit/deny entries based on source/destination IP, protocol, and port.
Platform Notes
In IOS-XE (e.g., 16.x), the `ip access-list resequence` command syntax and behavior are identical to classic IOS. The command is available in global configuration mode and works with both standard and extended named ACLs. In NX-OS, the equivalent command is `ip access-list resequence` but with slightly different syntax: `ip access-list resequence <name> <start> <increment>`.
NX-OS also supports resequencing for IPv6 ACLs with `ipv6 access-list resequence`. In ASA, there is no direct resequence command; instead, you must manually renumber entries by removing and re-adding them with the desired sequence numbers. ASA uses a different ACL model where sequence numbers are optional and can be assigned when creating entries.
For IOS-XR, the command is not available; ACL entries are managed differently using a configuration-based approach where you can insert entries at specific positions using the `sequence` keyword. In older IOS versions (12.x), the command was introduced in 12.0(5)T. In 15.x and later, it remains unchanged.
There are no significant output format differences between versions. Always check the specific IOS version documentation for any caveats. For example, in some early implementations, resequencing an ACL that is applied to an interface could cause a brief interruption in traffic filtering; modern versions handle this gracefully.
When migrating from IOS to IOS-XE, the command works identically. For NX-OS, note that the default increment is 10, and the start value defaults to 10 if not specified. In all platforms, the command only affects the running configuration; you must save manually.
Related Commands
ip access-list extended [name]
Creates or enters an extended named access list to filter traffic based on source/destination IP, protocol, and port numbers, used for granular traffic control.
ip access-list standard [name]
Creates or enters a standard named IP access list to filter traffic based on source IP address, used to permit or deny packets in a Cisco IOS network.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions