Cisco CCNA Certification Exam Tutorial Access List Details You Must Know

Cisco Certification

Cisco Certification Central

Home | Article List | Submit An Article | Contact Us


Cisco CCNA Certification Exam Tutorial Access List Details You Must Know

To pass the CCNA exam, you have to be able to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you'll see more and more uses for ACLs. Therefore, you had better know the basics!

The use of "host" and "any" confuses some newcomers to ACLs, so let's take a look at that first.

It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of 0.0.0.0 means the address specified in the ACL line must be matched exactly a wildcard mask of 255.255.255.255 means that all addresses will match the line.

Wildcard masks have the option of using the word host to represent a wildcard mask of 0.0.0.0. Consider a configuration where only packets from IP source 10.1.1.1 should be allowed and all other packets denied. The following ACLs both do that.

R3#conf t

R3(config)#access-list 6 permit 10.1.1.1 0.0.0.0

R3(config)#conf t

R3(config)#access-list 7 permit host 10.1.1.1

The keyword any can be used to represent a wildcard mask of 255.255.255.255.



R3(config)#access-list 15 permit any

Another often overlooked detail is the order of the lines in an ACL. Even in a two- or three-line ACL, the order of the lines in an ACL is vital.

Consider a situation where packets sourced from 172.18.18.0 /24 will be denied, but all others will be permitted. The following ACL would do that.

R3#conf t

R3(config)#access-list 15 deny 172.18.18.0 0.0.0.255

R3(config)#access-list 15 permit any

The previous example also illustrates the importance of configuring the ACL with the lines in the correct order to get the desired results. What would be the result if the lines were reversed?

R3#conf t



R3(config)#access-list 15 permit any

R3(config)#access-list 15 deny 172.18.18.0 0.0.0.255

If the lines were reversed, traffic from 172.18.18.0 /24 would be matched against the first line of the ACL. The first line is ,permit any", meaning all traffic is permitted. The traffic from 172.18.18.0/24 matches that line, the traffic is permitted, and the ACL stops running. The statement denying the traffic from 172.18.18.0 is never run.

The key to writing and troubleshoot access lists is to take just an extra moment to read it over and make sure it's going to do what you intend it to do. It's better to realize your mistake on paper instead of once the ACL's been applied to an interface!

Chris Bryant, CCIE #12933, is the owner of The Bryant Advantage, home of freeCCNA andCCNP tutorials, The Ultimate CCNA Study Package, and Ultimate CCNP Study Packages.

You can also join his RSS feed and visit his blog, which is updated several times daily with new Cisco certification articles, free tutorials, and daily CCNA / CCNP exam questions! Details are on the website.

For a FREE copy of his latest e-books, ,How To Pass The CCNA, and ,How To Pass The CCNP,, visit the website and download your free copies. You can also get FREE CCNA and CCNP exam questions every day! Get yourCCNA study guide from The Bryant Advantage!

 

Full List of Articles
 

Latest Cisco Certification News:

  1. Gsolutionz Achieves Premier Certification From Cisco

    Gsolutionz, the west coast's premier voice and data specialist for small and medium sized businesses, has achieved Premier Certification from Cisco®. To earn Premier Certification, Gsolutionz had to meet standards for networking competency, service, support and customer satisfaction set forth by Cisco.

    Read More ...

  2. Apptis Technology Solutions Achieves Cisco Gold Partner Certification for Sixth Straight Year

    CHANTILLY, Va.----Apptis Technology Solutions , a division of Apptis, Inc., and a technology solutions provider and value-added reseller, announced today that it has completed all requirements for maintaining Cisco Gold Partner Certification.

    Read More ...

  3. Logicalis becomes Master of Cisco realm

    Doug Woodburn, CRN , Thursday 28 August 2008 at 10:23:00 Logicalis joins Touchbase, 2e2 and Didata in elite pack of resellers to hold Cisco Master UC specialisation Logicalis has become the fourth UK reseller to gain Cisco’s top level Master certification for unified communications (UC). Cisco unveiled the badge in 2006 as a way to differentiate elite...

    Read More ...

  4. Logicalis becomes Master of Cisco realm

    Logicalis has become the fourth UK reseller to gain Ciscos top level Master certification for unified communications (UC).

    Read More ...

  5. Linksys confirms cut-off date for making Cisco switch

    Linksys resellers in the Middle East have until 16th September to sign up as Cisco Registered Channel Partners following confirmation that the vendor’s partner programme is to finally be folded into Cisco’s own channel scheme.

    Read More ...

  6. Linksys confirms cut-off date for making Cisco switch

    Linksys channel program to be merged with Cisco SMB scheme by mid September

    Read More ...

  7. Linksys announces availability of its first simultaneous Dual-N Band wireless router

    Linksys, a Division of Cisco, the recognized leading global manufacturer of wireless, and networking hardware for home, announced the availability of its first simultaneous Dual-N Band router.

    Read More ...

Cisco Certification

Cisco CCNA Certification Exam Tutorial Access List Details You Must Know