Just a reminder again about remarks remarks allow us to add descriptions to access control lists so
that they are easier to understand with access less as they can get fairly complicated if you have a
10 line or 20 line ACL.
The last thing you want to do is decipher what the access list is intended to do.
So adding remarks can make it a lot easier to follow and understand typing the C'mon show access list.
Well Misratah shows me the access lists configured and at the moment you can see there are access lists
with various lines that they in themselves don't mean much other than doing that.
Let's create an access list it's the access list five hemat they say for instance 10 1.2 to 1.
But now what you can do is you can say access list five Ramshaw and now you can put in a remark up to
100 characters.
So something like that
the meet the boss X-ists to exchange server or whatever you decide.
Now topping that come on show X-ists list
doesn't show that remark but not as if I do the C'mon show run.
Inkley access list.
Notice the remark is displayed in the access list which makes it a lot easier to see what's going on.
I could create another line that ex-wrestler Salita Exorcist 5 Tumut.
And then I could create another a mock
something like this.
And now doing the same come on again show run piping CLEET Exorcist
allows me to see each line in the access list and it's relevant remark thus making it a lot easier to
understand what's going on.
Some guidelines regarding access lists mostly the top of access list indicates what can be filtered.
In other words a standard the access list can only on Source IP addresses or networks an extended access
list can filter both on source and destination addresses source and destination port numbers and various
other options relating to IP protocols.
So extended access lists tend to be a lot more powerful.
The order of processing is also of great importance.
You should place your more specific statements first if your first statement was commit any and your
second statement was deny host 10 1 1 1 second deny statement would be irrelevant because of your first
statement saying permit any Remember access control lists or process top down.
If there's a match on a line all subsequent lines are ignored.
So I permit any would be matched and all traffic including traffic from host 10:01 one one would be
permitted and the second line denying host 10 one on one would be ignored.
Don't forget that there's an implicit deny all at the end of every Access Control list unless you explicitly
permit something it's going to be denied.
Only one access list can be bound her interface per direction per protocol.
In other words an IP version 4 ACL can be bound either in or out on a per interface basis.
You cannot have to provision for access lists inbound on the same interface that you can have one in
and one out.
As I've already demonstrated if you tried bind two IP access lists inbound on the same interface the
second one will just replace the first one.
So where should you place your access lists.
Now the best practice from Cisco is to place stented ACLC as close to the destination as possible.
And the reason for this is that you cannot match specific protocols.
Now in the real world most HLL implementations will be using extended IP access lists because of the
fact that you can filter based on both source and destination IP address as well as source and destination
ports and so forth.
Whereas with IP stented access control lists you can only fall to based on the source address.
So in this example if you didn't want 10 1 on 1 to connect to the server 10 1 to 1 you could bind a
standard IP access list either inbound on or one for outbound and or one or inbound and or two or outbound
and arty.
If you decided to bind an access list denying this host inbound and or one you would not only deny 10
1 1 1 access to the server but you would also deny the host access to all other parts of the network
because she cannot specify a destination but only a source if you bound an access list in Bonan or one
denying host 10 1 1 1.
You would deny that host access to all parts of the network so this wouldn't be a good place to bind
that access list.
If you bomb the access list outbound and or one saying denie host 10 one on one the host would be allowed
access to this host.
Once again 10:01 one one would be denied access to this network.
This network as well as this network because once again you can only to deny on the source address with
a standard IP access list not on the destination or port numbers.
If you decided to bind the access list inbound and or to the host 10:01 one one would have access to
this network as well as this network but it wouldn't have access to this network or this network so
that wouldn't work either.
And lastly if you decided to bind the access list outbound on r t that would be the optimum place to
place the access list because you would be denying host 10 one one one access to the server that you
wouldn't be denying that host access to any other part of the network and that you would accomplish
what you set out to do.
However with the extended IP access lists the recommendation is to place the access list as close to
the source as possible.
The reason for this is that you can match specific protocols and specific destination addresses.
So if you burn an access list inbound and or one you could say deny this host 10 1 1 1 access to this
host 10 1 to 1 but permit this host access to any other part of the network and thus you would accomplish
what you set out to do.
And this example would be a lot more efficient than the previous example because you would be denying
traffic at this point rather than routing it all the way across the network to or to just to be dropped.
So you extended IP access lists are a lot more flexible and a lot more efficient and thus tend to be
used more in the real world.