Solved: Extended ACL permit ip and allowed ports

mahesh18 · ‎05-09-2013

Hi everyone

Need to confirm if we have extended ACL with object group below

access-list xy_access_in extended permit ip object-group xy_subnets object-group cisco_ynetworks

will above ACL allow all the ports on the destination object group?

Thanks

mahesh

Jouni Forss · ‎05-09-2013

Hi,

The ACL rule by itself would mean that TCP/UDP traffic would be allowed on ANY destination or source port from the xy_subnets to cisco_ynetworks

Do notice this very important fact when configuring ACLs

If you have some ACL rule before this mentioned ACL rule in the mentioned ACL and its set to block some ports and the rules source/destination addresses apply to the source/destination networks in these "object-group" then its possible that some ports get blocked even though this rule alone would allow them

- Jouni

View solution in original post