Please enable JavaScript.

Coggle requires JavaScript to display documents.

ACL for IPv4 Configuration, image - Coggle Diagram

- - - - Always include a permit any at the end (otherwise everything is denied).
      - Place ACLs as close as possible to the destination.
      - Document ACL rules for clarity.
- - - - After an ACL is configured, it may need to be modified. ACLs with multiple ACEs can be complex to configure. Sometimes the configured ACE does not yield the expected behaviors. For these reasons, ACLs may initially require a bit of trial and error to achieve the desired filtering result.
      - This section will discuss two methods to use when modifying an ACL:
        -Use a Text Editor
        -Use Sequence Numbers
      - 5.2.2 Text Editor Method
        
        Access Control Lists (ACLs) with multiple entries should be created in a text editor to avoid mistakes and simplify editing. In the example, an ACL was incorrectly configured to deny an entire subnet instead of a specific host. To fix it, the ACL must be copied, edited externally, and then re-entered into the router. Simply pasting new commands won’t overwrite existing entries. The correct procedure involves deleting the old ACL and applying the updated version in global configuration mode. This ensures accurate access control and avoids configuration errors.
        
        5.2.3 Sequence Numbers Method
        
        This method uses sequence numbers to manage ACL entries more efficiently. Unlike the running configuration, the show access-lists command displays sequence numbers for each ACE. You can delete or modify specific entries by referencing their sequence number. For example, entry 10 (denying 192.168.10.10) can be removed and re-added with corrected parameters. This avoids having to delete the entire ACL and simplifies updates. The configuration is done in standard ACL mode using commands like no 10 and then redefining entry 10.
        
        5.2.4 Modify a Named ACL Example
        
        This example shows how to configure a named standard ACL on a Cisco router. The ACL called "NO-ACCESS" is created to deny traffic from a specific host (192.168.10.5) and permit the rest of the 192.168.10.0/24 network. Sequence numbers (15 and 20) define the order of rules, which is crucial since ACLs are processed top-down. The configuration is done in global mode using ip access-list standard NO-ACCESS, followed by the deny and permit statements. This setup helps control access efficiently while keeping the rest of the network reachable.