ACLs are created in the global configuration mode. There are many different types of ACLs including standard, extended, IPX, AppleTalk, and others. When configuring ACLs on a router, each ACL must be uniquely identified by assigning a number to it. This number identifies the type of access list created and must fall within the specific range of numbers that is valid for that type of list.

After the proper command mode is entered and the list type number is decided upon, the user enters the access list statements using the keyword access-list, followed by the proper parameters. Creating the access list is the first half of using them on a router. The second half of the process is assigning them to the proper interface.

ACLs are assigned to one or more interfaces and can filter inbound traffic or outbound traffic by using the access-group command. The access-group command is issued in the interface configuration mode. When assigning an ACL to an interface inbound or outbound placement should be specified. The filter direction can be set to check packets that are traveling into or out of an interface. When determining if the ACL is addressing inbound or outbound traffic, the network administrator needs to look at at the interfaces from inside the router. This is a very important concept. Traffic coming in from an interface is filtered by an inbound access list, traffic going out an interface is filtered by the outbound access list. After creating a numbered ACL, it must be assigned to an interface. To alter an ACL containing numbered ACL statements, all the statements in the numbered ACL must be deleted by using the command no access-list list-number.

These basic rules should be followed when creating and applying access lists:

• One access list per protocol per direction.
• Standard access lists should be applied closest to the destination.
• Extended access lists should be applied closest to the source.
• Use the inbound or outbound interface reference as if looking at the port from inside the router.
• Statements are processed sequentially from the top of list to the bottom until a match is found, if no match is found then the packet is denied.
• There is an implicit deny at the end of all access lists. This will not appear in the configuration listing.
• Access list entries should filter in the order from specific to general. Specific hosts should be denied first, and groups or general filters should come last.
• The match condition is examined first. The permit or deny is examined ONLY if the match is true.
• Never work with an access list that is actively applied.
• Use a text editor to create comments outlining the logic, then, fill in the statements that perform the logic.
• New lines are always added to the end of the access list. A no access-list x command will remove the whole list. It is not possible to selectively add and remove lines with numbered ACLs.
• An IP access list will send an ICMP host unreachable message to the sender of the rejected packet and will discard the packet in the bit bucket.
• Care should be used when removing an access list. If the access list is applied to a production interface and the access list is removed, depending on the version of the IOS, there may be a default deny any applied to the interface, and all traffic will be halted.
• Outbound filters do not affect traffic originating from the local router.

Interactive Media Activity Drag and Drop: Creating ACLs After completing this activity, the student will be able to create ACLs.

Web Links ACL http://www.foothilltech.org/tsharif/ apjohns0_Ch06__ ACLs%5B1%5D.ppt