topic Re: History, benefit, using of gt and lt in ACL rule in Network Security

History, benefit, using of gt and lt in ACL rule

mgae2m400 — Sun, 09 Aug 2020 08:06:09 GMT

As rules below:

10 access-list 102 permit tcp any host 192.168.1.100 eq ftp
20 access-list 102 permit tcp any host 192.168.1.100 gt 1023

What is History, benefit, using gt and lt (line 20)?

Is there meaning in ports sequence number?

Regards.

Re: History, benefit, using of gt and lt in ACL rule

Rob Ingram — Sun, 09 Aug 2020 08:24:20 GMT

Hi,
"gt" = greater than, which in your example this is permitting all dynamic ports above 1023, so from tcp port 1023 - 65535. Normally you'd specify "eq" which specifies the exact port, but in some circumstances you may wish to permit the dynamic ports for some applications, such as MS RPC.

Sequence number is important, the ACL is processed top down, so first match takes precedence. If a packet matches seq #10, then it will be permitted and not process the rest of the ACL. It also helps with re-ordering the ACE.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-3s/sec-data-acl-xe-3s-book/sec-acl-seq-num.html

HTH

Re: History, benefit, using of gt and lt in ACL rule

r.heitmann — Tue, 16 Jan 2024 11:08:36 GMT

just to keep it exact:

"gt" = greater than, which in your example this is permitting all dynamic ports above 1023, so from tcp port 1024 - 65535.

...gt is not "equal or greater than", just "greater than"