Cisco CCNA Certification Exam Tutorial: Access List Details You Must Know!

By: Chris Bryant
Submitted: 2007-01-17 15:44:42
Print this article | Tell a friend | For publisher | Social Bookmarking
Rating:
 

To pass the CCNA exam, you have to be able to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you'll see more and more uses for ACLs. Therefore, you had better know the basics!

The use of "host" and "any" confuses some newcomers to ACLs, so let's take a look at that first.

It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of 0.0.0.0 means the address specified in the ACL line must be matched exactly a wildcard mask of 255.255.255.255 means that all addresses will match the line.

Wildcard masks have the option of using the word host to represent a wildcard mask of 0.0.0.0. Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied. The following ACLs both do that.

R3#conf t

R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0

R3(config)#conf t

R3(config)#access-list 7 permit host 10.1.1.1

The keyword any can be used to represent a wildcard mask of 255.255.255.255.

R3(config)#access-list 15 permit any

Another often overlooked detail is the order of the lines in an ACL. Even in a two- or three-line ACL, the order of the lines in an ACL is vital.

Consider a situation where packets sourced from 172.18.18.0 /24 will be denied, but all others will be permitted. The following ACL would do that.

R3#conf t

R3(config)#access-list 15 deny 172.18.18.0 0.0.0.255

R3(config)#access-list 15 permit any

The previous example also illustrates the importance of configuring the ACL with the lines in the correct order to get the desired results. What would be the result if the lines were reversed?

R3#conf t

R3(config)#access-list 15 permit any

R3(config)#access-list 15 deny 172.18.18.0 0.0.0.255

If the lines were reversed, traffic from 172.18.18.0 /24 would be matched against the first line of the ACL. The first line is “permit any", meaning all traffic is permitted. The traffic from 172.18.18.0/24 matches that line, the traffic is permitted, and the ACL stops running. The statement denying the traffic from 172.18.18.0 is never run.

The key to writing and troubleshoot access lists is to take just an extra moment to read it over and make sure it's going to do what you intend it to do. It's better to realize your mistake on paper instead of once the ACL's been applied to an interface!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of free CCNA and CCNP tutorials, The Ultimate CCNA Study Package, and Ultimate CCNP Study Packages.

You can also join his RSS feed and visit his blog, which is updated several times daily with new Cisco certification articles, free tutorials, and daily CCNA / CCNP exam questions! Details are on the website.

For a FREE copy of his latest e-books, “How To Pass The CCNA” and “How To Pass The CCNP”, visit the website and download your free copies. You can also get FREE CCNA and CCNP exam questions every day! Get your CCNA study guide from The Bryant Advantage!

Article source: Expert Articles

Most Recent Articles in Certification Tests category

  • A word about MCSE, A+ and CCNA Braindump Certification. - By: M. Aslam
    Braindumps are engaged in is an illegal practice that has seismic effects on all concerned. How is it illegal? Every candidates going for IT certification is required to sign non disclosure agreement not to leak the exam related information. But leaks still happen and it is these the leaks have given birth to braindumps providers who are mushrooming by days.
  • Why should you avoid getting a Braindump Certification? - By: M. Aslam
    Generally speaking, Braindumps refers to lists of questions and answers from an actual IT certification exam. This dangerous, illegal and unethical trend is like a plague to IT profession as well as industry.
  • 7 Layers of the OSI Reference Model - By: M. Aslam
    The Application Layer (Layer 7) refers to communication services to applications and is the interface between the network and the application. Most application layer protocols offer services that programs use to access the network, such as the Simple Mail Transfer Protocol (SMTP). Application layer protocols often include the session and presentation layer functions. A typical protocol stack consists of four separate protocols, which run at the application, transport, network, and data-link la
  • How to Take Local Business to Next Level - By: Sudesh Kumar
    A recent study by a leading marketing consultant reveals that most shoppers use the Internet to surf local business offers and opportunities. Local business marketing has grown significantly during the past few years. Many companies offer services such as local promotion, local advertising, local business directory, local ads, business profiling and merchant advertising at easily affordable rates.
  • Cathay School Offers One-on-One CISCO CCIE Routing and Switching Boot Camp Training - By: Fandy Du
    two tracks for CCIE Routing and Switching Training,one is called Intensive Track (CRSLT-I), which takes 14 days to have it done, the other is called Fast Track (CRSLT-F) which probably takes 18 days.
  • The Benefits of Latest Computer Training Courses - By: Alok Kumar
    The field of education encompasses a wide variety of career paths and can prepare individuals to be programmers, software developers, systems analysts, database administrators, or computer scientists.
  • Why should you avoid getting a Braindump Certification? - By: M. Aslam
    Generally speaking, Braindumps refers to lists of questions and answers from an actual IT certification exam. This dangerous, illegal and unethical trend is like a plague to IT profession as well as industry
  • Why Does Certification Validate Your Skills as an IT Professional at ABCO Technology? - By: Alok Kumar
    ABCO Technology prepares individuals to work in the field of IT (Information Technology) or enhance individual's technical skills for other career areas. The field of education encompasses a wide variety of career paths and can prepare individuals to be programmers, software developers, systems analysts, database administrators, or computer scientists. Also provides Computer Training Courses, IT Training Courses, CCNA Training, MCSE Training and Many More.
  • Test Taking Techniques to Help You Get Certified! - By: john strong
    As always, tests and exams will scare you when you think about getting certified. Remember that you won’t die if you flunk the test and life won’t fall apart either. Relax, prepare and give the test. Here’s how!
  • IP Address Classes, and Address Masks - By: Vijayanand Yadla
    IP AddressingAn IP address is a unique logical identifier for a node or host connection on an IP network. IP address is a 32 bit binary number, and represented by 4 decimal values of 8 bits each. The decimal values range from 0 to 255.