remark [comment text]
Adds a descriptive comment to an access control entry (ACE) in an ACL to document its purpose, without affecting traffic filtering.
Definition: remark [comment text] is a Cisco IOS acl config command. Adds a descriptive comment to an access control entry (ACE) in an ACL to document its purpose, without affecting traffic filtering.
Overview
The `remark` command in Cisco IOS access control list (ACL) configuration mode allows network engineers to attach descriptive text comments to individual access control entries (ACEs). This command does not affect traffic filtering; its sole purpose is to document the intent, owner, or business justification for a specific ACE. In large-scale networks with hundreds of ACL lines, remarks are invaluable for maintainability, troubleshooting, and audit compliance.
Without remarks, engineers often rely on cryptic object names or external documentation, which quickly becomes outdated. The `remark` command embeds context directly into the running configuration, ensuring that anyone reviewing the ACL—months or years later—understands why a particular permit or deny statement exists. This is especially critical in environments subject to regulatory standards like PCI-DSS or HIPAA, where each rule must be justified.
The command is entered in ACL configuration mode (after defining the ACL with `ip access-list extended` or `ip access-list standard`). Each remark is associated with the next ACE entered; if you add a remark after an ACE, it applies to the subsequent entry. Remarks appear in the running configuration as lines starting with `remark` and are displayed when using `show access-list` or `show running-config | section access-list`.
They do not consume hardware resources (TCAM) and have no performance impact. Alternatives include using descriptive object-group names or external documentation, but these lack the direct coupling to the ACL entry. The `remark` command is supported in all IOS versions (12.x, 15.x, 16.x) and IOS-XE, with identical syntax.
In NX-OS, the equivalent is `remark` within the ACL configuration, but NX-OS also supports `ip access-list` with remarks. For ASA, remarks are supported in both classic and object-group ACLs. The command is available in privileged EXEC mode (enable) and requires global configuration access.
It is a best practice to add a remark for every ACE, especially deny statements that might be questioned later. The remark text can be up to 100 characters (some platforms support longer). Common mistakes include placing remarks in the wrong order (remarks apply to the next ACE, not the previous) or using remarks to explain obvious entries (e.g., "permit ip any any" needs no remark).
Overall, the `remark` command is a simple but powerful documentation tool that enhances network reliability and team collaboration.
remark [comment text]When to Use This Command
- Documenting why a specific permit or deny statement exists in a long ACL for easier troubleshooting
- Adding version or author information to an ACL for change management
- Labeling temporary test rules so they can be easily identified and removed later
- Providing context for complex ACLs shared among multiple network engineers
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| comment text | TEXT | A string of up to 100 characters (some platforms allow up to 256) that describes the purpose of the subsequent ACE. The text is not parsed or validated; it is stored as-is. Common mistakes include forgetting that the remark applies to the next ACE, not the previous one, and using special characters that might be misinterpreted (though IOS handles most characters). |
Command Examples
Adding a remark to a standard ACL entry
R1(config-ext-nacl)# remark Allow HTTP traffic from internal subnet to web serverNo output is generated; the remark is stored in the running configuration. Use 'show access-lists' to view remarks.
Viewing remarks in an ACL
show access-lists 101Extended IP access list 101
10 remark Allow HTTP traffic from internal subnet to web server
20 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www
30 remark Block all other traffic (implicit deny)
40 deny ip any anyLine 10: remark describing the permit statement. Line 20: the actual permit ACE. Line 30: remark for the implicit deny. Line 40: explicit deny (optional). Remarks appear as separate lines with sequence numbers.
Understanding the Output
The 'show access-lists' command displays ACL entries in order. Remarks appear as lines starting with 'remark' followed by the comment text. They are numbered with sequence numbers (e.g., 10, 30) and do not affect packet matching.
Remarks help document the purpose of adjacent ACEs. In a real network, use remarks to explain why certain traffic is permitted or denied, making ACLs easier to audit and troubleshoot. There are no 'good' or 'bad' values—remarks are purely informational.
Configuration Scenarios
Documenting a permit rule for management access
A network engineer needs to allow SSH access from a management subnet (10.10.10.0/24) to all network devices. To ensure future administrators understand the rule's purpose, a remark is added before the permit statement.
Topology
Management Host (10.10.10.5)---(Gi0/0)Router1(Gi0/1)---Core NetworkSteps
- 1.Step 1: Enter global configuration mode: Router# configure terminal
- 2.Step 2: Create or edit an extended ACL: Router(config)# ip access-list extended MGMT_ACL
- 3.Step 3: Add a remark before the permit statement: Router(config-ext-nacl)# remark Allow SSH from management subnet
- 4.Step 4: Add the permit statement: Router(config-ext-nacl)# permit tcp 10.10.10.0 0.0.0.255 any eq 22
- 5.Step 5: Exit and apply the ACL to an interface (e.g., VTY lines or interface): Router(config-ext-nacl)# exit; Router(config)# line vty 0 4; Router(config-line)# access-class MGMT_ACL in
! ip access-list extended MGMT_ACL remark Allow SSH from management subnet permit tcp 10.10.10.0 0.0.0.255 any eq 22 !
Verify: Use `show access-list MGMT_ACL` to verify the remark appears before the permit entry. Expected output includes a line like "10 remark Allow SSH from management subnet" followed by the permit entry.
Watch out: If the remark is placed after the permit statement, it will apply to the next ACE (which may not exist), leaving the permit undocumented. Always add the remark immediately before the intended ACE.
Documenting a deny rule for compliance
A company policy requires blocking traffic from a known malicious IP (198.51.100.1) to any internal server. A remark is added to justify the deny for audit purposes.
Topology
Internet---(Gi0/0)EdgeRouter(Gi0/1)---Internal Network (192.168.1.0/24)Steps
- 1.Step 1: Enter global configuration mode: Router# configure terminal
- 2.Step 2: Create an extended ACL: Router(config)# ip access-list extended EDGE_IN
- 3.Step 3: Add a remark explaining the deny: Router(config-ext-nacl)# remark Block known malicious host per security policy
- 4.Step 4: Add the deny statement: Router(config-ext-nacl)# deny ip host 198.51.100.1 any
- 5.Step 5: Add a permit for legitimate traffic: Router(config-ext-nacl)# permit ip any any
- 6.Step 6: Apply the ACL inbound on the external interface: Router(config)# interface GigabitEthernet0/0; Router(config-if)# ip access-group EDGE_IN in
! ip access-list extended EDGE_IN remark Block known malicious host per security policy deny ip host 198.51.100.1 any permit ip any any !
Verify: Use `show access-list EDGE_IN` to confirm the remark appears before the deny entry. Also check `show running-config | section ip access-list extended EDGE_IN` to see the remark in the config.
Watch out: If the remark is accidentally placed after the deny statement, it will be associated with the next ACE (the permit), leaving the deny undocumented. Always double-check the order using `show access-list`.
Troubleshooting with This Command
When troubleshooting ACL issues, the `remark` command is not directly used to diagnose problems, but it aids in understanding the intended behavior. A healthy ACL configuration will have remarks that clearly describe each ACE's purpose. If you encounter unexpected traffic being permitted or denied, first examine the ACL with `show access-list` and look for remarks that might be misleading or missing.
For example, if a remark says "Allow HTTP from management" but the actual ACE permits all TCP traffic, the remark reveals a configuration error. Conversely, if a remark is missing, you may need to infer the intent from context. In a diagnostic flow, start by listing all ACLs applied to interfaces with `show ip interface` or `show running-config | include access-group`.
Then, for each relevant ACL, run `show access-list <acl-name>` and note the sequence numbers and remarks. If a remark is absent for a critical ACE, consider adding one after confirming the rule's purpose with the team. Pay special attention to remarks that are vague (e.g., "Temp rule")—these often indicate temporary changes that were never cleaned up.
When correlating with other debug commands, such as `debug ip packet` or `debug ip access-list`, the remarks help you quickly identify which ACE is being hit. For instance, if `debug ip access-list` shows a match on sequence 20, you can look up the remark for that sequence to understand why the packet was permitted or denied. In complex scenarios with multiple ACLs, remarks act as a map, reducing analysis time.
Another common issue is that remarks are not displayed in `show access-list` output on some older IOS versions; if you don't see remarks, verify the IOS version and consider upgrading. Finally, when auditing ACLs for compliance, remarks are the first place to check for justification. If a deny rule lacks a remark, it may be flagged during an audit.
In summary, while remarks don't affect traffic, they are a powerful troubleshooting aid when used consistently.
CCNA Exam Tips
CCNA exam may test that remarks are placed before the ACE they describe, not after.
Remember that remarks do not affect ACL logic; they are only for documentation.
Know that remarks are stored in the running configuration and can be viewed with 'show running-config | section access-list' or 'show access-lists'.
The exam might ask which command adds a comment to an ACL without affecting traffic filtering.
Common Mistakes
Placing the remark after the ACE it describes, which can confuse readers.
Forgetting that remarks are not part of the ACL matching logic and cannot be used to filter traffic.
Using special characters or spaces in the remark text without quotes (though IOS accepts most characters).
Assuming remarks are automatically numbered; they use the next available sequence number.
remark [comment text] vs show access-lists
Both 'remark' and 'show access-lists' are ACL-related commands, but they serve very different purposes. 'remark' adds static comments inside the ACL configuration to document entries, while 'show access-lists' displays live ACL statistics including hit counts. They are commonly confused because newcomers might think remarks are visible in the show output or that the show command can modify ACLs.
| Aspect | remark [comment text] | show access-lists |
|---|---|---|
| Scope | Single ACE within an ACL | Entire ACL or all ACLs on the device |
| Configuration mode | ACL configuration mode (config-ext-nacl or config-std-nacl) | Privileged EXEC mode |
| Persistence | Saved in running-config and startup-config | Output only; no configuration change |
| Effect on traffic | None (purely documentation) | None (display only) |
| Output detail | Shown only in 'show running-config' or 'show access-list' with sequence numbers | Shows sequence numbers, match criteria, and hit counts |
Use remark [comment text] when you need to document the purpose of a specific ACE inside an ACL for future reference or compliance.
Use show access-lists when you need to verify ACL configuration, check hit counts for troubleshooting traffic flow, or confirm ACL order.
Platform Notes
In IOS-XE (e.g., 16.x), the `remark` command syntax is identical to classic IOS. However, the output of `show access-list` may include additional fields like hit counts in a slightly different format. In NX-OS (e.g., 7.x, 9.x), the `remark` command is also supported within ACL configuration mode, but the syntax for entering ACL config is `ip access-list <name>` (similar to IOS).
NX-OS also supports `remark` in IPv6 ACLs. On Cisco ASA (8.x and later), remarks are supported in both classic ACLs and object-group ACLs. The ASA syntax is `remark <text>` within the ACL configuration.
For example: `access-list OUTSIDE extended permit tcp any any eq www` followed by `access-list OUTSIDE remark Allow web traffic`. Note that on ASA, the remark is attached to the preceding ACE (unlike IOS where it applies to the next). This is a critical difference: on IOS, the remark applies to the next ACE; on ASA, it applies to the previous ACE.
Always verify the platform behavior. In IOS-XR, ACL remarks are not supported in the same way; instead, you can use the `comment` keyword in the ACL configuration, but it is not as widely used. For example, in IOS-XR, you can add a comment using `!` or `remark` but the syntax may vary by version.
Overall, the `remark` command is consistent across most Cisco platforms, but the order of association (next vs previous ACE) differs between IOS and ASA. Always test on your specific platform.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions