topic ACL setup in Network Security https://community.cisco.com/t5/network-security/acl-setup/m-p/1618608#M559643 <P>I am trying to setup an ACE on our ASA 5520 where I need to allow a subnet access but block 2 ip address within that subnet.&nbsp; Should I do the permit statement for the subnet first or should I put the deny statement for the ip addresses first?&nbsp; For example say I did an permit statement for host 10.170.8.0 255.255.255.0 to include that whole subnet, but I wanted to deny access just for 10.170.8.5 and 10.170.8.6.&nbsp; Would that be:</P><P></P><P>access-list OUT extended deny ip host 10.170.8.5 any any</P><P>access-list OUT extended deny ip host 10.170.8.6 any any</P><P>access-list OUT extended permit ip host 10.170.8.0 255.255.255.0 any any</P> Mon, 11 Mar 2019 20:08:42 GMT Mitchell Theriot 2019-03-11T20:08:42Z ACL setup https://community.cisco.com/t5/network-security/acl-setup/m-p/1618608#M559643 <P>I am trying to setup an ACE on our ASA 5520 where I need to allow a subnet access but block 2 ip address within that subnet.&nbsp; Should I do the permit statement for the subnet first or should I put the deny statement for the ip addresses first?&nbsp; For example say I did an permit statement for host 10.170.8.0 255.255.255.0 to include that whole subnet, but I wanted to deny access just for 10.170.8.5 and 10.170.8.6.&nbsp; Would that be:</P><P></P><P>access-list OUT extended deny ip host 10.170.8.5 any any</P><P>access-list OUT extended deny ip host 10.170.8.6 any any</P><P>access-list OUT extended permit ip host 10.170.8.0 255.255.255.0 any any</P> Mon, 11 Mar 2019 20:08:42 GMT https://community.cisco.com/t5/network-security/acl-setup/m-p/1618608#M559643 Mitchell Theriot 2019-03-11T20:08:42Z Re: ACL setup https://community.cisco.com/t5/network-security/acl-setup/m-p/1618609#M559644 <HTML><HEAD></HEAD><BODY><P>the deny statements first and then the permit statements. You have it correct.</P><P></P><P><SPAN></SPAN></P><P>access-list OUT extended deny ip host 10.170.8.5 any any</P><P>access-list OUT extended deny ip host 10.170.8.6 any any</P><P>access-list OUT extended permit ip host 10.170.8.0 255.255.255.0 any</P><P></P><P>Remember the access-group</P><P></P></BODY></HTML> Thu, 17 Mar 2011 20:03:48 GMT https://community.cisco.com/t5/network-security/acl-setup/m-p/1618609#M559644 PAUL GILBERT ARIAS 2011-03-17T20:03:48Z