122 - 238 CCNA 2: Routers and Routing Basics v3.1 Instructor Guide – Module 11 Copyright © 2004, Cisco Systems, Inc.
A.B.C.D Wildcard bits
log Log matches against this entry
<cr>
rt1(config)#access-list 1 permit 192.168.0.1 0.0.0.0 ?
log Log matches against this entry
<cr>
Give students a list of rules for access lists to help them understand this concept. Emphasize
the following points:
• Use one access list for each protocol and for each direction.
• Place standard access lists closest to the destination.
• Place extended access lists closest to the source.
• Apply the "in” or “out" keyword as if from inside the router.
• Remember statements are processed sequentially from the top of the list until a
match is found and if no match is found, the packet is denied.
• Remember there is an implicit “deny all” at the end of ACLs that will not appear in
the configuration listing.
• Remember, the match condition is examined first and the permit or deny is
examined ONLY if the match is true.
• List statements from specific references such as individual hosts to general
references such as entire networks when access list logic overlaps.
• Do not work with an access list that is actively applied.
• Use Notepad or a similar text editor to create comments that outline the logic and
then fill in the statements that perform the logic.
• Remember new lines are always added to the end of the access list.
• Use the no access-list x command to remove an entire list since it is not
possible to selectively add and remove lines.
• Remember that an IP access list will send an ICMP host unreachable message to
the sender of a rejected packet and will discard the packet.
• Use care when removing an access list. If the access list is applied to a production
interface and it is removed, there may be a default “deny any” applied to the
interface and all traffic will be halted. If the IOS defaults to “permit all”, there will be
no security or performance regulation.
• Remember outbound filters do not affect traffic that originates from the local router.
These rules will help students become successful with using ACLs. This is not an all-inclusive
list and it can be presented in any order.