One of the problems with taking an existing BNF and turning it into a regular expression is that the most BNFs assume an implicite tokenization. Pattern matching doesn't tokenize. For instance, "access_listfoopermitiphost123host456eq789" is matched by your pattern.

For the Cisco ACL, one might get away with requiring whitespace between each token, but in general, that will not work.