BarajasCoffin950

To pass the CCNA exam, you have to be able to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you are going to see a lot more and a lot more makes use of for ACLs. For that reason, you had much better know the basics! The use of "host" and "any" confuses some newcomers to ACLs, so let's take a appear at that initial. It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of ... signifies the address specified in the ACL line need to be matched precisely a wildcard mask of 255.255.255.255 means that all addresses will match the line. Wildcard masks have the alternative of using the word host to represent a wildcard mask of .... Consider a configuration where only packets from IP supply ten.1.1.1 should be permitted and all other packets denied. The following ACLs each do that. R3#conf t R3(config)#access-list 6 permit 10.1.1.1 ... R3(config)#conf t R3(config)#access-list 7 permit host ten.1.1.1 The keyword any can be utilized to represent a wildcard mask of 255.255.255.255. R3(config)#access-list 15 permit any certificate management An additional typically overlooked detail is the order of the lines in an ACL. Even in a two- or 3-line ACL, the order of the lines in an ACL is vital. Take into account a situation exactly where packets sourced from 172.18.18. /24 will be denied, but all others will be permitted. The following ACL would do that. security certificate R3#conf t R3(config)#access-list 15 deny 172.18.18. ...255 R3(config)#access-list 15 permit any The preceding example also illustrates the value of configuring the ACL with the lines in the right order to get the desired outcomes. What would be the result if the lines were reversed? R3#conf t ssl R3(config)#access-list 15 permit any R3(config)#access-list 15 deny 172.18.18. ...255 If the lines had been reversed, visitors from 172.18.18. /24 would be matched against the first line of the ACL. The very first line is permit any", meaning all visitors is permitted. The traffic from 172.18.18./24 matches that line, the targeted traffic is permitted, and the ACL stops running. The statement denying the site visitors from 172.18.18. is never ever run. The important to writing and troubleshoot access lists is to take just an extra moment to read it over and make confident it is going to do what you intend it to do. It really is better to recognize your mistake on paper rather of once the ACL's been applied to an interface!