topic Re: Standard IP access list Behaviour in Network Access Control

Standard IP access list Behaviour

bp.noc — Mon, 11 Mar 2019 08:54:06 GMT

Hello Guys,

I have query for ACL configured on my Cisco Router

For Example:-

Standard IP access list 10
10 deny any
Standard IP access list 25
10 permit 172.17.204.98
20 permit 172.17.1.205
30 permit 172.19.126.236
40 permit 172.18.1.89

So how this will work. Does all the traffic will deny?

When the deny for access list 10 will work and when the standard access list 25 will work

What is the use of sequence number in IP access-list.

Any help will be appreciated.

Re: Standard IP access list Behaviour

Mohammed al Baqari — Mon, 21 Jan 2019 07:47:26 GMT

The access-lists are assigned to interfaces. Once the interface is selected
based on routing of outgoing traffic or the interface that received
traffic, the assigned ACL will be selected and applied.

Re: Standard IP access list Behaviour

balaji.bandi — Mon, 21 Jan 2019 08:22:03 GMT

These 2 are conside 2 access list, you need to apply them in the respected interface to take affective.

both work in different way, the way you apply in the direction.

If i understand correctly you looking to permit certain IP and rest deny then below should work for you.

remove ACL 10

Standard IP access list 25
10 permit 172.17.204.98
20 permit 172.17.1.205
30 permit 172.19.126.236
40 permit 172.18.1.89

50 deny any any

Apply the ACL to respected interface.

look some reference guide :

https://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html

Re: Standard IP access list Behaviour

bp.noc — Mon, 21 Jan 2019 09:27:37 GMT

Thank you very much for your response.

So you meant to say, if I will have below access-list on the top of ACL, then it will deny all traffic?

For Example :-

Standard IP access list 10
10 deny any

Standard IP access list Vty_Access
10 permit 172.18.120.10

************

Also I am having issue to reach syslog server, is it because of the ACL on router, I am not able to access the syslog server.

There is Cisco ASA firewall between Syslog server and Router. From Firewall I can able to get syslog.

I am facing issue with router but When I am doing packet tracer from ASA it saw no drop till syslog server.

Any help in this as well really appreciated.

Re: Standard IP access list Behaviour

balaji.bandi — Mon, 21 Jan 2019 17:05:18 GMT

yes when you apply below ACL everything will be denied.

Standard IP access list 10

Fix the ACL and test syslog, or remove the ACL and test and start adding one by one building the ACL by tsting, until you get hands on and understand how the ACL working.