Named ACLs
ip access-list extended GUEST_IN opens a named ACL, and the lines go underneath. A name says what the ACL is for, which a number never does.
Sequence numbers
Every line has a sequence number: 10, 20, 30... by default. Inside the ACL you can:
- insert a line between two others:
15 permit ...; - delete one line:
no 20; - leave a note:
remark ....
In NetLab
▶ R1 R1>enable R1#show access-lists GUEST_IN Extended IP access list GUEST_IN 10 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www 20 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq 443 30 deny ip any any R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#ip access-list extended GUEST_IN R1(config-ext-nacl)#25 permit icmp 192.168.20.0 0.0.0.255 any echo R1(config-ext-nacl)#no 20 R1(config-ext-nacl)#end *Mar 1 00:00:07.000: %SYS-5-CONFIG_I: Configured from console by console R1#show access-lists GUEST_IN Extended IP access list GUEST_IN 10 permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www 25 permit icmp 192.168.20.0 0.0.0.255 any echo 30 deny ip any any R1#show running-config | section ip access-list ip access-list extended GUEST_IN remark guests: web server only permit tcp 192.168.20.0 0.0.0.255 host 10.1.1.10 eq www permit icmp 192.168.20.0 0.0.0.255 any echo deny ip any any ▶ GUEST student@GUEST:~$ ping -c 2 10.1.1.10 PING 10.1.1.10 (10.1.1.10) 56(84) bytes of data. 64 bytes from 10.1.1.10: icmp_seq=2 ttl=63 time=0.640 ms --- 10.1.1.10 ping statistics --- 2 packets transmitted, 1 received, 50% packet loss, time 1001ms rtt min/avg/max/mdev = 0.640/0.640/0.640/0.000 ms
Common mistake: With a numbered ACL,
no access-list 110 deny tcp any anydoesn't remove one line: it deletes the whole ACL 110. Edit numbered ACLs in the named mode instead:ip access-list extended 110, thenno 30.
Remember: An ACL that is applied but doesn't exist (or is empty) permits everything. Write the ACL first, then apply it, and check with
show ip interfaceandshow access-lists.