EstaDame326
出典: くみこみックス
To pass the CCNA exam, you have to be in a position to write and troubleshoot access lists. As you climb the ladder toward the CCNP and CCIE, you are going to see far more and a lot more utilizes for ACLs. Therefore, you had better know the fundamentals!
The use of "host" and "any" confuses some newcomers to ACLs, so let's take a look at that first.
It is acceptable to configure a wildcard mask of all ones or all zeroes. A wildcard mask of ... implies the address specified in the ACL line should be matched precisely a wildcard mask of 255.255.255.255 indicates that all addresses will match the line.
Wildcard masks have the alternative of making use of the word host to represent a wildcard mask of .... Think about a configuration where only packets from IP source ten.1.1.1 should be permitted and all other packets denied. The following ACLs each do that.
R3#conf t
R3(config)#access-list 6 permit 10.1.1.1 ...
R3(config)#conf t
R3(config)#access-list 7 permit host ten.1.1.1
The keyword any can be utilised to represent a wildcard mask of 255.255.255.255.
R3(config)#access-list 15 permit any
Yet another frequently overlooked detail is the order of the lines in an ACL. Even in a two- or 3-line ACL, the order of the lines in an ACL is crucial.
Take into account a circumstance exactly where packets sourced from 172.18.18. /24 will be denied, but all other individuals will be permitted. The following ACL would do that.
R3#conf t
R3(config)#access-list 15 deny 172.18.18. ...255
R3(config)#access-list 15 permit any
The preceding instance also illustrates the significance of configuring the ACL with the lines in the right order to get the desired outcomes. What would be the result if the lines had been reversed?
R3#conf t
R3(config)#access-list 15 permit any
R3(config)#access-list 15 deny 172.18.18. ...255
If the lines were reversed, traffic from 172.18.18. /24 would be matched against the very first line of the ACL. The initial line is permit any", which means all site visitors is permitted. The targeted traffic from 172.18.18./24 matches that line, the targeted traffic is permitted, and the ACL stops running. The statement denying the site visitors from 172.18.18. is by no means run.
The important to writing and troubleshoot access lists is to take just an extra moment to read it more than and make certain it's going to do what you intend it to do. It is greater to recognize your mistake on paper as an alternative of after the ACL's been applied to an interface! multi domain ssl entrust entrust
