Basic ACL question 2

[North323]

I thought that acl's are processed top down...correct? so what is the best way these rules should be added:


access-list 100 deny ip 14.2.6.0 0.0.0.255 any log
access-list 100 deny ip 127.0.0.0 0.255.255.255 any log
access-list 100 deny ip 10.0.0.0 0.255.255.255 any log
access-list 100 deny ip 0.0.0.0 0.255.255.255 any log
access-list 100 deny ip 172.16.0.0 0.15.255.255 any log
access-list 100 deny ip 192.168.0.0 0.0.255.255 any log
access-list 100 deny ip 192.0.2.0 0.0.0.255 any log
access-list 100 deny ip 169.254.0.0 0.0.255.255 any log
access-list 100 deny ip 224.0.0.0 15.255.255.255 any log
access-list 100 deny ip host 255.255.255.255 any log
access-list 100 deny icmp any any echo log
access-list 100 deny icmp any any redirect log
access-list 100 deny icmp any any mask-request log
access-list 100 deny udp any any log
access-list 100 permit ip any X.Y.156.0 0.0.0.127 log


or

access-list 100 permit ip any X.Y.156.0 0.0.0.127 log
access-list 100 deny ip 14.2.6.0 0.0.0.255 any log
access-list 100 deny ip 127.0.0.0 0.255.255.255 any log
access-list 100 deny ip 10.0.0.0 0.255.255.255 any log
access-list 100 deny ip 0.0.0.0 0.255.255.255 any log
access-list 100 deny ip 172.16.0.0 0.15.255.255 any log
access-list 100 deny ip 192.168.0.0 0.0.255.255 any log
access-list 100 deny ip 192.0.2.0 0.0.0.255 any log
access-list 100 deny ip 169.254.0.0 0.0.255.255 any log
access-list 100 deny ip 224.0.0.0 15.255.255.255 any log
access-list 100 deny ip host 255.255.255.255 any log
access-list 100 deny icmp any any echo log
access-list 100 deny icmp any any redirect log
access-list 100 deny icmp any any mask-request log
access-list 100 deny udp any any log

 

[drewdown]

I will tell you one thing "permit ip any any" needs to be at the bottom or no traffic will be allowed.

The first list is what you want.

 

[North323]

are you 110% positively sure?

 

[drewdown]

Yes. ACL's have an implicit deny at the end of them, if you don't add the permit statement no traffic will be allowed.

By default, there is an implicit deny all clause at the end of every ACL. Anything that is not explicitly permitted is denied.

Read up about it here:

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml

 

[brianinms]

I always use named extended acl's. It makes it easy logically for people to troubleshoot down the road. Additionally it is a million times to edit later on.

 

[burtsbees]

If

access-list 100 permit ip any X.Y.156.0 0.0.0.127 log

is all you want, then that is the only statement you need---no deny statements are necessary, if this is the only traffic you need.

Brian---you can edit numbered acl's the same way you edit named acls, after release 12.1 or something. Also, keeping this in mind, you can put "description filter blabla traffic" in there as well.

Burt

 

[brianinms]

Yes, burt I was aware ... I just used named acls as its easier for me to remember what the acl is used for in my old age and all.

 

[burtsbees]

Define old...lol

Burt

 

[brianinms]

31

 

[burtsbees]

Yes, you are getting up there...lol

Burt