| 10.1 |  | Access Control Lists and the PIX Security Appliance |
| 10.1.6 |  | Verifying and troubleshooting ACLs |

| It is often useful to view or troubleshoot access control lists. This section will look at two basic commands that are used.

- show access-list
- debug access-list

show access-list command
The show access-list command allows an administrator to quickly view all of the access control lists configured on a PIX Security Appliance. Alternatively, it is possible to view a particular ACL by specifying it in the statement. One useful feature provided by this command is a count of how many times an element or line item of the ACL has been hit by traffic. The debug access-list and debug packet commands can be used to troubleshoot ACLs on the PIX.

From configuration mode, the clear access-list command removes all access-list command statements from the configuration or, if specified, access lists by their acl_ID. This command also stops all traffic through the PIX on the affected access-list command statements. The no access-list command removes an access-list command from the configuration. If all the access-list command statements are removed in an access list, the no access-list command also removes the corresponding access-group command from the configuration.
The clear access-list acl_ID counters command clears the hit count for a specified access list.