Access-list Question

[Microbyte]

Does router goes thru each line of particular access-list list until it reaches the bottom? or does the search stops when it finds a first match?

for example:

access-list 120 permit ip any any
access-list 120 deny tcp any any eq telnet

would the router gets to the 2nd deny tcp line?


And...how about this...can this be possible? If it is how would it affect the router?

access-list 120 permit ip any any
access-list 120 deny ip any any

what would happen in this case? This maybe stupid question, if it is I apolegize, but I am curious and bit confused.
Thanks.





Microbyte

 

[cloakanddagga]

Access-lists are processed from top down, with the first match principle.

Thus (in your first example) you would never get to the access-list 120 deny tcp any any eq telnet. In the second statement you would never get to the deny ip any any as all traffic is permitted above.

Also remember that there is an implicit deny ip any any at the end of every access-list. I've had to learn that fact the hardway.

Hope this helps.

 

[Microbyte]

thanks for your help.

Microbyte

 

[geek911]

hey its not the way u think ,
it gets stucked @ the 1st matching access-list it can lay its eyes on
then no processing goes from there.
i will advise using named access-lists so u can manipulate the way u want.
c-ya @ the hall of fame!

 

[NMCman]

The last update is correct. The access luist is applied to the interface either incoming or outgoing. When the packeet goes through the router interface in teh desired direction the access list is applied. If there is a match the packet is either forwarded or denied as per line in access list to the explicit deny at the end.

Be careful on the layout of the access list. It goes down one by one until it gets a match. So if you allow all traffic through on 172.165.39.0 network then have a deny for 172.165.39.5 on the next line the packet will already have gone through. Take this into account when writing access lists.

 

[pmesjar]

Just a regard for specifying "ip" as a protocol in extended access-list - for router it means to look for any protocol that "runs" on IP - is TCP, UDP, all IP routing protocols, ICMP...

And never forget that any standard access-list has implicit "deny any" and extended "deny ip any any" rule as the last line, however it is not shown.

Peter Mesjar
CCNP, A+ certified
pmesjar@centrum.sk

"The only true wisdom is in knowing you know nothing.