BarnumCushing26

To pass the CCNA exam, you have to be in a position to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you will see far more and more makes use of for ACLs. For that reason, you had much better know the basics!

The use of "host" and "any" confuses some newcomers to ACLs, so let's take a look at that first.

It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of ... signifies the address specified in the ACL line must be matched exactly a wildcard mask of 255.255.255.255 signifies that all addresses will match the line.

Wildcard masks have the choice of using the word host to represent a wildcard mask of .... Consider a configuration where only packets from IP source 10.1.1.1 must be permitted and all other packets denied. The following ACLs both do that.

R3#conf t

R3(config)#access-list 6 permit ten.1.1.1 ...

R3(config)#conf t

R3(config)#access-list 7 permit host ten.1.1.1

The keyword any can be utilized to represent a wildcard mask of 255.255.255.255.

R3(config)#access-list 15 permit any

Another frequently overlooked detail is the order of the lines in an ACL. Even in a two- or 3-line ACL, the order of the lines in an ACL is crucial.

Contemplate a situation where packets sourced from 172.18.18. /24 will be denied, but all other individuals will be permitted. The following ACL would do that.

R3#conf t

R3(config)#access-list 15 deny 172.18.18. ...255

R3(config)#access-list 15 permit any

The preceding instance also illustrates the value of configuring the ACL with the lines in the correct order to get the desired results. What would be the result if the lines had been reversed?

R3#conf t

R3(config)#access-list 15 permit any

R3(config)#access-list 15 deny 172.18.18. ...255

If the lines were reversed, traffic from 172.18.18. /24 would be matched against the first line of the ACL. The first line is permit any", meaning all visitors is permitted. The visitors from 172.18.18./24 matches that line, the traffic is permitted, and the ACL stops running. The statement denying the site visitors from 172.18.18. is in no way run.

The crucial to writing and troubleshoot access lists is to take just an additional moment to read it more than and make certain it's going to do what you intend it to do. It's much better to recognize your mistake on paper as an alternative of after the ACL's been applied to an interface! ssl certificate entrust entrust