JobieWilson67

To pass the CCNA exam, you have to be able to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you will see far more and more utilizes for ACLs. As a result, you had better know the basics!

The use of "host" and "any" confuses some newcomers to ACLs, so let's take a appear at that initial.

It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of ... implies the address specified in the ACL line should be matched exactly a wildcard mask of 255.255.255.255 implies that all addresses will match the line.

Wildcard masks have the choice of making use of the word host to represent a wildcard mask of .... Take into account a configuration exactly where only packets from IP source 10.1.1.1 must be permitted and all other packets denied. The following ACLs both do that.

R3#conf t

R3(config)#access-list 6 permit ten.1.1.1 ...

R3(config)#conf t

R3(config)#access-list 7 permit host ten.1.1.1

The keyword any can be employed to represent a wildcard mask of 255.255.255.255.

R3(config)#access-list 15 permit any

An additional usually overlooked detail is the order of the lines in an ACL. Even in a two- or 3-line ACL, the order of the lines in an ACL is essential.

Consider a situation where packets sourced from 172.18.18. /24 will be denied, but all others will be permitted. The following ACL would do that.

R3#conf t

R3(config)#access-list 15 deny 172.18.18. ...255

R3(config)#access-list 15 permit any

The preceding instance also illustrates the significance of configuring the ACL with the lines in the correct order to get the desired benefits. What would be the result if the lines were reversed?

R3#conf t

R3(config)#access-list 15 permit any

R3(config)#access-list 15 deny 172.18.18. ...255

If the lines had been reversed, traffic from 172.18.18. /24 would be matched against the very first line of the ACL. The initial line is permit any", meaning all visitors is permitted. The visitors from 172.18.18./24 matches that line, the site visitors is permitted, and the ACL stops running. The statement denying the targeted traffic from 172.18.18. is never ever run.

The essential to writing and troubleshoot access lists is to take just an extra moment to read it over and make positive it is going to do what you intend it to do. It's better to comprehend your mistake on paper rather of as soon as the ACL's been applied to an interface! ssl ssl email ssl