Cisco Systems CCNA 2 manual C.D Wildcard bits Log

A.B.C.D Wildcard bits

log	Log matches against this entry
<cr>

rt1(config)#access-list 1 permit 192.168.0.1 0.0.0.0 ? log Log matches against this entry

<cr>

Give students a list of rules for access lists to help them understand this concept. Emphasize the following points:

•Use one access list for each protocol and for each direction.

•Place standard access lists closest to the destination.

•Place extended access lists closest to the source.

•Apply the "in” or “out" keyword as if from inside the router.

•Remember statements are processed sequentially from the top of the list until a match is found and if no match is found, the packet is denied.

•Remember there is an implicit “deny all” at the end of ACLs that will not appear in the configuration listing.

•Remember, the match condition is examined first and the permit or deny is examined ONLY if the match is true.

•List statements from specific references such as individual hosts to general references such as entire networks when access list logic overlaps.

•Do not work with an access list that is actively applied.

•Use Notepad or a similar text editor to create comments that outline the logic and then fill in the statements that perform the logic.

•Remember new lines are always added to the end of the access list.

•Use the no access-listx command to remove an entire list since it is not possible to selectively add and remove lines.

•Remember that an IP access list will send an ICMP host unreachable message to the sender of a rejected packet and will discard the packet.

•Use care when removing an access list. If the access list is applied to a production interface and it is removed, there may be a default “deny any” applied to the interface and all traffic will be halted. If the IOS defaults to “permit all”, there will be no security or performance regulation.

•Remember outbound filters do not affect traffic that originates from the local router.

These rules will help students become successful with using ACLs. This is not an all-inclusive list and it can be presented in any order.

122 - 238 CCNA 2: Routers and Routing Basics v3.1 Instructor Guide – Module 11 Copyright ♥ 2004, Cisco Systems, Inc.