use Data::Dump;

my $acl_grammar = do {
    use Regexp::Grammars;
    qr{
        # In case you need it, uncomment this line:
        # <debug:on>

        # Match this...
        <acl>

        # According to these definitions:

        <rule: acl>          access-list <interface_name> extended <action> <protocol> <source> <destination> <port> <comment>
        <rule: action>       permit | deny
        <rule: protocol>     tcp | udp | ip | object-group <object_group_name>
        <rule: object_group> object-group <object_group_name>
        <rule: source>       object-group <object_group_name> | host <host_address> | <network_address> <net_mask>
        <rule: destination>  object-group <object_group_name> | host <host_address> | <network_address> <net_mask>
        <rule: port>         eq <port_number> | range <low_port> <high_port> |

        <rule: interface_name>    <name>
        <rule: object_group_name> <chunk>
        <rule: host_address>      <address>
        <rule: network_address>   <address>
        <rule: net_mask>          <address>
        <rule: port_number>       <portno>
        <rule: low_port>          <portno>
        <rule: high_port>         <portno>

        <rule: address>         any | <dotted_quad> | <name>
        <rule: portno>          \d+

        <token: dotted_quad> <.octet> ( <.dot> <.octet> ){3}

        <rule: comment>  \( [^()]* \)
        <token: chunk>  \w+

        <token: octet>  \d{0,3}
        <token: dot>    \.
        <token: name>  <.capword> ** _
        <token: capword> \p{Lu} \p{Alnum}+

    }x;
};

while (my $input = <DATA>) {
    if ($input =~ $acl_grammar) {
        say "MATCHED";
        dd \%/;       # parse tree of a successful match
                          # appears in the %/ variable
    } else {
        warn "CAN'T MATCH: $input";
    }
}
__END__
access-list V420_IN extended permit object-group Symantec_Service_Group object-group Symantec_Clients Symantec_Servers (all 3 object groups)
access-list V421_IN extended permit object-group Symantec_Service_Group 10.148.0.0 255.254.0.0 host 10.149.16.40  (One service group and two network addresses)
access-list V422_IN extended permit object-group Symantec_Service_Group any any (Source & Destination any)
access-list V423_IN extended permit tcp any any range 137 139 (with a range of TCP ports)
access-list V424_IN extended permit tcp any any eq 445 (with a single service port)