Basic query regarding ACL

[mukundh86]

Hi

I have  a very basic question regarding ACL operation. Say I have an access-list as follows

access-list 101 deny ip any host 4.2.2.2

access-list 101 permit tcp any host 4.2.2.2 eq 80

If my understanding is correct, tany http traffic to 4.2.2.2 will be denied right?

For the same access-list will http traffic to 4.2.2.2 be denied if replace the first statement with deny icmp any host 4.2.2.2?

Thanks

Mukundh

[Eugene Lau]

Hi Mukundh,

access-list 101 deny ip any host 4.2.2.2  <<----- denies all IP packet to 4.2.2.2

access-list 101 permit tcp any host 4.2.2.2 eq 80  <<--- is redundant as all packets are dropped by first line (ACE - access control entry)

Edit to clear behavioiur up:

access-list 101 deny icmp any host 4.2.2.2 <<------ deny ICMP to 4.2.2.2

access-list 101 permit tcp any host 4.2.2.2 eq 80 <<------ allow only HTTP port 80 request to 4.2.2.2

<<<<<<<<<<<<<<< drop everything else

Thus HTTP port 80 would not be dropped in this type of ACL.

HTH

Eugene

[mukundh86]

Thanks a lot!!!!

[cadet alain · Accepted solution]

Hi Eugene,

For the same access-list will http traffic to 4.2.2.2 be denied if replace the first statement with deny icmp any host 4.2.2.2?

I don't agree with you when you say yes to this question because the second line is a permit and so replacing the first line with deny icmp will permit

http traffic to 4.2.2.2 as the implicit deny is after the second line.

Regards.

Alain.

[Eugene Lau]

Alain you are correct! Apologies, I read it wrong when I answered yes.

I think I over complicated the description as well when I mentioned that HTTP to 4.2.2.2 would still be allowed Will edit.

[mukundh86]

Thanks a lot Alain