topic Re: ACL Nestingvs Service Policy in Routing and SD-WAN

ACL Nestingvs Service Policy

SivaKesava — Tue, 06 Nov 2018 20:52:10 GMT

Hi all,

Consider two extended ACLs (extended_ACL1, extended_ACL2). If I want to apply both of them (allowed by any one of them) on the input for an interface I have to create a new ACL(merged_Extended) and then apply using

"ip access-group merged_Extended in"

Is there any other better way?

Consider the same scenario where both the ACLs are to be applied. If I create a class-maps as follows:
class-map match-any map1

match access-group name extended_ACL1

match access-group name extended_ACL2

Then create a policy-map as:

policy-map merged

class map1

pass

class class-default

drop

Now If I apply these to the interface as :

interface TenGigabitEthernet1/4

service-policy input merged

Is this a right approach? Can it be done like this?

Re: ACL Nestingvs Service Policy

paul driver — Tue, 06 Nov 2018 09:46:40 GMT

Hello

My understanding this wont work, The interface will it probably take the policy but the router wont process it.

Whats wrong using just the one extended acl to do the job?

Re: ACL Nestingvs Service Policy

SivaKesava — Tue, 06 Nov 2018 21:05:48 GMT

Consider the router config where we have defined extended_ACL1 and extended_ACL2 and use them on some interfaces. For another interface, I want to apply both of them(allowed by any one of the ACL) so I have to now create another extended ACL by copying lines from extended_ACL1 and extended_ACL2 and putting them together. This increases the config text so I was asking if there are any alternatives(like the one I suggested)?

ip access-list extended_ACL1
permit ip ....
permit ip ....

ip access-list extended_ACL2
permit udp ....
permit udp ....

ip access-list extended_merged
permit ip ....
permit ip ....
permit udp ...
permit udp ...

Re: ACL Nestingvs Service Policy

paul driver — Wed, 07 Nov 2018 08:54:47 GMT

Hello

@SivaKesava wrote:
so I was asking if there are any alternatives(like the one I suggested)?

As far as I am aware I dont think there is, but that's not to say there isnt one.