access-list issue

[abbas.ali]

I have a access-list implemented with the following lines with 24 bit mask

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.201 eq 443

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.201 eq 1494

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.202 eq 443

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.202 eq 1494

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.203 eq 443

access-list 110 permit tcp 10.252.1.0 0.0.0.255 host 10.0.0.203 eq 1494

Now I want to open some additional ports but only at the 29 bit level 10.252.1.64/29 with the following lineks

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.53

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.70

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.58

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.59

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.60

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.48

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.55

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.91.86

access-list 110 permit ip 10.252.1.64 0.0.0.7 host 10.0.14.250

Will it work.  because under 24 bit mask there must be a host with 10.252.1.64/24 so with the added configuration it may deny or permit everything.

Please advise!

[varrao]

Hi Abbas,

If the ports you are opening for them are different then there won,t be an issue, because in the earlier ACL's you've opened port 443 and 1494. To eliminate any confusion apply the new ACL's on top of the list.

Do "show access-list", check on whihc line do you have these access-list and add the neqw acl's on top of it by using the line number in acl. for eg these existing acl's are on line 1, so for new acl's

access-list 110 line 1 permit ip 10.252.1.64 0.0.0.7 host 10.0.0.53

so the new one would be on line 1 and the rest would be pushed down.

the more specofoc access-list should always be on top.

Hope this helps

Thanks,

Varun