1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Which order to apply access lists?

Discussion in 'Routing & Switching' started by llcooljsl, May 30, 2011.

  1. llcooljsl

    llcooljsl Bit Poster

    12
    0
    12
    Hey, I have my CCNA exam on Tuesday and I have bought the Boson software to practice on.

    I seem to be getting the right access lists from the drag and drop options, but I am applying them in the wrong order apparently.

    Can anyone shed some light on the rules for this as I can't seem to see any logic or patterns....

    thanks

    Jamie
     
    Certifications: A+ Net+ Sec+ MCP MCTS MCSA:Security MCSE CSSA CCNA
    WIP: MCITP: EA
  2. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    Access Lists go from the top down e.g.

    ip access-list extended LANTraffic
    permit tcp 192.168.0.0 0.0.0.255 host x.x.x.x eq smtp
    permit tcp 192.168.1.0 0.0.0.255 host x.x.x.x eq smtp
    permit tcp 192.168.0.0 0.0.0.255 host x.x.x.x eq smtp
    permit tcp 192.168.0.0 0.0.0.255 host x.x.x.x eq pop3
    permit tcp 192.168.1.0 0.0.0.255 host x.x.x.x eq pop3
    permit tcp 192.168.0.0 0.0.0.255 host x.x.x.x eq pop3
    permit tcp 192.168.1.0 0.0.0.255 host x.x.x.x eq 143
    permit tcp 192.168.0.0 0.0.0.255 host x.x.x.x.x eq 143
    permit tcp 192.168.1.0 0.0.0.255 host x.x.x.x.x eq 143
    deny tcp any any eq smtp
    deny tcp any any eq pop3
    deny tcp any any eq 143
    permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
    permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
    permit ip 192.168.0.0 0.0.0.255 any
    permit ip 192.168.1.0 0.0.0.255 any
    #####Silent Deny#####

    So this access list permits any thing from the 192.168.0.0/24 and 192.168.1.0/24 network out on SMTP, POP3 and IMAP4 but then denys any other network from doing the same.

    It then allows 192.168.0.0/24 and 192.168.1.0/24 out on any port and again the silent deny blocks any other network.
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  3. llcooljsl

    llcooljsl Bit Poster

    12
    0
    12
    Sorry I wasn't clear with my post, I understand that they are applied from top down, but it is my understanding that you have to apply them in a specific order or it is 'wrong'.

    How did you choose which access list rules to go 1st, 2nd, 3rd etc...

    thanks

    Jamie
     
    Certifications: A+ Net+ Sec+ MCP MCTS MCSA:Security MCSE CSSA CCNA
    WIP: MCITP: EA
  4. jonny7_2002

    jonny7_2002 Byte Poster

    191
    9
    37
    Was going to ask for more info but looks like today is your judgment day! lol

    Good luck with the exam, youll be fine! Let us know th outcome.... good or bad!
     
    Certifications: CCNA R&S, CCNP R&S, CCDA, CCNA Voice, CCNA Wireless & CCNA Security
    WIP: CCIE V5 (when its out)
  5. GW

    GW Byte Poster

    119
    4
    39
    Reply anyways, I'm struggling with ACL as well.

    GW
     
    Certifications: MCP x4, CompTia x3
    WIP: Cisco CCNA
  6. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    I don't really remember any specifics with ACL's in the CCNA.

    Just always remember to do your allow before your deny's.
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  7. llcooljsl

    llcooljsl Bit Poster

    12
    0
    12
    Hey, I passed with 933 / 1000...
     
    Certifications: A+ Net+ Sec+ MCP MCTS MCSA:Security MCSE CSSA CCNA
    WIP: MCITP: EA
  8. craigie

    craigie Terabyte Poster

    3,020
    173
    155
    Congrats mate
     
    Certifications: CCA | CCENT | CCNA | CCNA:S | HP APC | HP ASE | ITILv3 | MCP | MCDST | MCITP: EA | MCTS:Vista | MCTS:Exch '07 | MCSA 2003 | MCSA:M 2003 | MCSA 2008 | MCSE | VCP5-DT | VCP4-DCV | VCP5-DCV | VCAP5-DCA | VCAP5-DCD | VMTSP | VTSP 4 | VTSP 5
  9. jonny7_2002

    jonny7_2002 Byte Poster

    191
    9
    37
    congrats dude!
     
    Certifications: CCNA R&S, CCNP R&S, CCDA, CCNA Voice, CCNA Wireless & CCNA Security
    WIP: CCIE V5 (when its out)
  10. csx

    csx Megabyte Poster

    511
    6
    81
    Congratz! :)
     
    Certifications: A+, Network+, 70-271 & 70-272, CCENT, VCP5-DCV and CCNA
    WIP: Citrix

Share This Page

Loading...