topic Re: ACL in Network Access Control

ACL

will75136 — Wed, 22 Apr 2020 23:16:33 GMT

Hello experts, I have a question about ACL.

I have configured the first requirement like below on both R1 and R2.

access-list 101 deny tcp 192.168.2.0 0.0.0.255 host 192.168.1.3 eq www

Though it works, I found that my PC in 192.168.3.0 network could not ping 192.168.1.0 network either.

Is there something I miss?

Re: ACL

Martin L — Wed, 22 Apr 2020 23:57:18 GMT

do you have permit ip any any ?

each ACL has impicit deny at the end of ACL; Such entry is not visible normally. therefore, you need permit any Or permit ip any any Or specific network/host. i,e permit icmp any any to ping , in your example, you may see access-list 101 deny ip any any as last entry.

if you want to ping or allow other traffic, add access-list 101 permit ip any any

Regards, ML
**Please Rate All Helpful Responses **

Re: ACL

will75136 — Thu, 23 Apr 2020 03:14:24 GMT

Thank you, sir.

It works well.
Does ACL execute the access-list in order?
It seems everything after "permit ip any any" will be ignore, isn`t it? (I still can access the ftp server.)
!
ip access-group 101 out
access-list 101 deny tcp 192.168.2.0 0.0.0.255 host 192.168.1.3 eq www
access-list 101 permit ip any any
access-list 101 deny tcp 192.168.3.0 0.0.0.255 host 192.168.1.4 eq ftp
!

Re: ACL

Martin L — Thu, 23 Apr 2020 04:17:05 GMT

Yes, ACL order is from top to the bottom but it can stop once the match is found. In your case, you have 3 lines, line 3 is never read because line 2 will match all traffic (everything). router will never get to line 3. you have to re-arrange order.