With 12.4 onwards, you can see that Cisco IOS adds sequence numbers to each ACL entry. So now I can create an access control list and then remove a line from it.
Router(config)#ip access-list standard test
Router(config-std-nacl)#permit 172.16.1.1
Router(config-std-nacl)#permit 192.168.1.1
Router(config-std-nacl)#permit 10.1.1.1
Router(config-std-nacl)#
Router(config-std-nacl)#exit
Router(config)#exit
Router#
*Jun 6 07:38:14.155: %SYS-5-CONFIG_I: Configured from console by console access
Router#show ip access-lists
Standard IP access list test
30 permit 10.1.1.1
20 permit 192.168.1.1
10 permit 172.16.1.1
Note that the sequence numbers are not displayed in the router running configuration. In order to see them you have to issue a show [ip] access-list command.
Add an ACL Line
To add a new ACL line, you can simply enter the new sequence number and then the ACL statement. The example below shows how you can add line 15 to your existing ACL:
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#ip access
Router(config)#ip access-list standard test
Router(config-std-nacl)#15 permit 172.20.1.1
Router(config-std-nacl)#
Router(config-std-nacl)#do show ip access
Router(config-std-nacl)#do show ip access-lists
Standard IP access list test
30 permit 10.1.1.1
20 permit 192.168.1.1
15 permit 172.20.1.1
10 permit 172.16.1.1
Router(config-std-nacl)#
Remove an ACL Line
To remove an ACL line, you can simply enter the no <seq_number> command, like in the example below where line 20 is deleted:
Router#conf t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#ip access
Router(config)#ip access-list standard test
Router(config-std-nacl)#no 20
Router(config-std-nacl)#
Router(config-std-nacl)#do show ip access
Router(config-std-nacl)#do show ip access-lists
Standard IP access list test
30 permit 10.1.1.1
15 permit 172.20.1.1
10 permit 172.16.1.1
Router(config-std-nacl)#
Resequence an ACL
To resequence an ACL, you can use the ip access-list resequence <acl_name> <starting_seq_number> <step_to_increment> command. The behaviour of this command can be examined in the example below:
Router(config)#ip access-list resequence test 100 20
Router(config)#do show ip access-lists
Standard IP access list test
100 permit 10.1.1.1
120 permit 172.20.1.1
140 permit 172.16.1.1
Router(config-std-nacl)#
The resequence command created new sequence numbers, starting from 100, and incremented them by 20 for each new ACL line.