topic ACE "deny ip any any" includes whole IP stack? in Network Security

ACE "deny ip any any" includes whole IP stack?

MicJameson1 — Mon, 02 Jan 2023 18:19:45 GMT

Hello.

ACE- "deny ip any any". What exactly does "IP" mean here? ,because the next line in the ACL reads...

"permit tcp any any eq 631"

implies TCP within IP.

Thank you!

Re: ACE "deny ip any any" includes whole IP stack?

MHM Cisco World — Mon, 02 Jan 2023 18:21:33 GMT

for extended ACL there is
ip <<- check the IP header
udp <<- check the L4 UDP port
tcp <<- check the L4 TCP port
icmp <<- check the protocol type ICMP

Re: ACE "deny ip any any" includes whole IP stack?

MicJameson1 — Mon, 02 Jan 2023 18:26:41 GMT

MHM, Is there anything you don't know?

Re: ACE "deny ip any any" includes whole IP stack?

Rob Ingram — Mon, 02 Jan 2023 18:28:29 GMT

@MicJameson1 using "ip" in an ACL would match on source and destination IP address. Whereas using "tcp" in the ACE would match on the source and destination IP and TCP port.

Generally when you permit traffic you are specific with the UDP/TCP port, but denying traffic you generally deny on IP.

Re: ACE "deny ip any any" includes whole IP stack?

MHM Cisco World — Mon, 02 Jan 2023 18:31:13 GMT

All thanks to @Rob Ingram I learn from him a lot. and still learning from Him.
so thanks @Rob Ingram

Re: ACE "deny ip any any" includes whole IP stack?

MicJameson1 — Mon, 02 Jan 2023 18:37:19 GMT

Who is a better captain-- J. Kirk or J. Picard?

Re: ACE "deny ip any any" includes whole IP stack?

Rob Ingram — Mon, 02 Jan 2023 18:41:35 GMT

@MicJameson1 Sisko

Re: ACE "deny ip any any" includes whole IP stack?

MHM Cisco World — Mon, 02 Jan 2023 18:45:14 GMT

Happy new year friends.