ACL clarification

[Raja_D]

Can someone explain the major difference between the below commands:

deny tcp host x.x.x.x any

deny ip host x.x.x.x any

Thanks,

James..

[Georg Pauwen]

James,

IP works at the network layer (3) of the OSI model, TCP at the transport layer (4). That means:

deny ip host x.x.x.x any

will block anything originating from the specified host to anywhere.

TCP is used by e.g. HTTP, HTTPs, FTP, SMTP, Telnet. You can block these selectively and still allow e.g. UDP (which operates at the same layer as TCP), such as DNS, DHCP, TFTP, SNMP, RIP, VOIP..

So in short:

deny ip host x.x.x.x any --> blocks everything

deny tcp host x.x.x.x any --> blocks only TCP, but allows UDP

[Raja_D]

Thanks George for the clarification..

James..