topic Two questions ACL in Network Access Control

Two questions ACL

Yanaqr — Mon, 20 Jul 2020 12:10:31 GMT

Hi,

1.which type of ACL allow for removing a single entery without removing the entire ACL?

2. which type of ACL allows you to open port only after someone has successfully logged into router?

Thanks

Re: Two questions ACL

balaji.bandi — Mon, 20 Jul 2020 15:28:18 GMT

you can have ACL with only number replace and add, rather removing all ACL.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-3s/sec-data-acl-xe-3s-book/sec-acl-seq-num.html

which type of ACL allows you to open port only after someone has successfully logged into router?

required more information and example of the use case - since this can be achieved in different ways.

Re: Two questions ACL

Martin L — Mon, 20 Jul 2020 22:48:21 GMT

All standard, extended, and Named ACLs allow for removing a single entry without removing the entire ACL; Long time ago, like pre-IOS 12.2 or around that time, standard ACL could not be edited such way. New IOS fixed that issue by applying numbering to ACL entries.

If you look at category like traditional ACL (old standard acl) vs Named acl vs Numbered acl (extended and new standard acls), then "old" traditional could not be edited (at least the easy way).

There are other ACL categorizes: Role-based, Time-based, reflexive ACLs, and dynamic ACL

will attach source link once i lookup my notes

Regards, ML
**Please Rate All Helpful Responses **

Re: Two questions ACL

Martin L — Mon, 20 Jul 2020 22:49:05 GMT

Re: Q.2. looks like the Dynamic ACLs or lock-and-key ACLs are created to allow user access to a specific source/destination host through a user authentication process. Cisco implementations utilize IOS Firewall capabilities and do not hinder existing security restrictions.
source:
(https://community.cisco.com/t5/security-documents/acl/ta-p/3113522#toc-hId--767837352)